{"grype_matches":[{"artifact":{"id":"e5fa95139ee975f2","cpes":["cpe:2.3:a:andybalholm:brotli:v1.1.0:*:*:*:*:*:*:*"],"name":"github.com/andybalholm/brotli","purl":"pkg:golang/github.com/andybalholm/brotli@v1.1.0","type":"go-module","version":"v1.1.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:eLKJA0d02Lf0mVpIDgYnqXcUn0GqVmEFny3VuID1U3M=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6888","versionConstraint":"<1.2.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/andybalholm/brotli","version":"v1.1.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6888","fix":{"state":"fixed","versions":["1.2.7"],"available":[{"date":"2026-10-23","kind":"release","version":"1.2.7"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-11-09","epss":0.82641,"percentile":0.99669}],"risk":98.70000000000002,"urls":["https://github.com/andybalholm/brotli/commit/33c2a9884269798192b5ecf171288f98939dbe42","https://github.com/andybalholm/brotli/releases/tag/v1.2.7","https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv","description":"In github.com/andybalholm/brotli before v1.2.7, the decompressor allocates memory for Huffman tables and block-type trees on every meta-block header without bounding the cumulative allocations relative to the input size. A small crafted brotli stream containing many empty meta-blocks with new Huffman trees can trigger hundreds of megabytes of allocations per kilobyte of input, leading to denial of service.","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-111497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-11-09","epss":0.82641,"percentile":0.99669}],"urls":["https://github.com/andybalholm/brotli/releases/tag/v1.2.7","https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","http://www.openwall.com/lists/oss-security/2026/10/23/25","http://www.openwall.com/lists/oss-security/2026/10/24/6","http://www.openwall.com/lists/oss-security/2026/10/26/12","http://www.openwall.com/lists/oss-security/2026/10/26/13","http://www.openwall.com/lists/oss-security/2026/10/26/16","http://www.openwall.com/lists/oss-security/2026/11/03/2","https://broccoli2shell.com","https://github.com/advisories/GHSA-9v8h-qqgm-4m35","https://github.com/dotnet/announcements/issues/494","https://github.com/google/brotli/releases/tag/v1.0.10","https://github.com/google/brotli/releases/tag/v1.1.1","https://github.com/google/brotli/releases/tag/v1.2.1","https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","https://patchtheplanet.org/brotli","https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","https://cert-portal.siemens.com/productcert/html/ssa-045512.html","https://cert-portal.siemens.com/productcert/html/ssa-443410.html","https://cert-portal.siemens.com/productcert/html/ssa-898633.html","https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},{"id":"GHSA-c9gr-gmg4-2vqv","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:go","dataSource":"github"}]},{"artifact":{"id":"e055751ea35a0539","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.10?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.10","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-09","epss":0.01742,"percentile":0.77917}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-09","epss":0.01742,"percentile":0.77917}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119586","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-09","epss":0.01545,"percentile":0.75166}],"risk":0.7725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119586"},"relatedVulnerabilities":[{"id":"CVE-2026-119586","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-09","epss":0.01545,"percentile":0.75166}],"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."}]},{"artifact":{"id":"c76e629c8d688bb1","cpes":["cpe:2.3:a:libzstd1:libzstd1:1.4.8\\+dfsg-3build1:*:*:*:*:*:*:*"],"name":"libzstd1","purl":"pkg:deb/ubuntu/libzstd1@1.4.8%2Bdfsg-3build1?arch=amd64&distro=ubuntu-22.04&upstream=libzstd","type":"deb","version":"1.4.8+dfsg-3build1","language":"","licenses":["BSD-3-clause","Expat","GPL-2","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzstd1/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/libzstd1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzstd1:amd64.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libzstd1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libzstd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libzstd","version":"1.4.8+dfsg-3build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-4899","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4899","date":"2026-11-09","epss":0.01588,"percentile":0.75805}],"risk":0.47639999999999993,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4899"},"relatedVulnerabilities":[{"id":"CVE-2022-4899","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4899","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4899","date":"2026-11-09","epss":0.01588,"percentile":0.75805}],"urls":["https://github.com/facebook/zstd/issues/3200","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/","https://security.netapp.com/advisory/ntap-20230725-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4899","description":"A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun."}]},{"artifact":{"id":"4fe210576cd3da29","cpes":["cpe:2.3:a:avro_project:avro:v2.29.0:*:*:*:*:go:*:*"],"name":"github.com/hamba/avro/v2","purl":"pkg:golang/github.com/hamba/avro/v2@v2.29.0","type":"go-module","version":"v2.29.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:fkqoWEPxfygZxrkktgSHEpd0j/P7RKTBTDbcEeMdVEY=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5046","versionConstraint":"none (unknown)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/hamba/avro/v2","version":"v2.29.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5046","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46385","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46385","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46385","date":"2026-11-09","epss":0.00614,"percentile":0.49704}],"risk":0.46049999999999996,"urls":["https://github.com/iskorotkov/avro/commit/2ce4242e6095d93470ab3b37ed6082b0596f325c","https://github.com/iskorotkov/avro/commit/b124caa58a821f68f100d86f045f9753b88881e8"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w","description":"The Avro array and map decoders loop over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 and arm64 targets. A producer can declare a block of up to math.MaxInt64 elements followed by EOF or any truncated payload, and the decoder will attempt that many no-op iterations before propagating the error.\n\nThe realistic ceiling is indefinite until the worker is killed externally. A single hostile payload pins a CPU core until the process is OOM-killed, deadline-cancelled, or terminated, resulting in a remote, unauthenticated denial-of-service.\n\nThe fix exits the loop on the first inner-decode error."},"relatedVulnerabilities":[{"id":"CVE-2026-46385","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46385","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46385","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46385","date":"2026-11-09","epss":0.00614,"percentile":0.49704}],"urls":["https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/security/cve/CVE-2026-46385","https://bugzilla.redhat.com/show_bug.cgi?id=2483475","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46385.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46385","description":"iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 / arm64 targets — so a producer can declare a block of up to math.MaxInt64 (~9.2 × 10¹⁸) elements followed by EOF (or any truncated payload), and the decoder will attempt that many no-op iterations before propagating the error. The realistic ceiling is \"indefinite until the worker is killed externally\" — a single hostile payload pins a CPU core until the process is OOM-killed, deadline-cancelled, or terminated. Remote, unauthenticated denial-of-service. This vulnerability is fixed in 2.33.0."},{"id":"GHSA-w8j3-pq8g-8m7w","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46385","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46385","cwe":"CWE-835","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46385","date":"2026-11-09","epss":0.00614,"percentile":0.49704}],"urls":["https://github.com/iskorotkov/avro/security/advisories/GHSA-w8j3-pq8g-8m7w","https://nvd.nist.gov/vuln/detail/CVE-2026-46385"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-w8j3-pq8g-8m7w","description":"iskorotkov/avro: CPU Exhaustion in Decoder"}]},{"artifact":{"id":"4fe210576cd3da29","cpes":["cpe:2.3:a:avro_project:avro:v2.29.0:*:*:*:*:go:*:*"],"name":"github.com/hamba/avro/v2","purl":"pkg:golang/github.com/hamba/avro/v2@v2.29.0","type":"go-module","version":"v2.29.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:fkqoWEPxfygZxrkktgSHEpd0j/P7RKTBTDbcEeMdVEY=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5047","versionConstraint":"none (unknown)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/hamba/avro/v2","version":"v2.29.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5047","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46384","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46384","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46384","date":"2026-11-09","epss":0.00549,"percentile":0.46257}],"risk":0.41174999999999995,"urls":["https://github.com/iskorotkov/avro/commit/bed99b315ec097a1a5eb7ae074ef57a91848c583","https://github.com/iskorotkov/avro/commit/e1a570f9a8a4fe4b1bc2b4b1fb6d24e4a5f04358"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv","description":"Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets, the truncation paths can silently bypass byte-slice limits, select the wrong union branch, or hit a negative-make panic via wrap.\n\nThree sub-issues are not 32-bit-specific: cumulative-size arithmetic overflow in array and map decoders, negation of MinInt in block-header handling, and negative size in block reads. All three panic or bypass caps on any platform, giving an attacker a denial-of-service primitive. Exploitation requires only an untrusted Avro stream."},"relatedVulnerabilities":[{"id":"CVE-2026-46384","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46384","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46384","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46384","date":"2026-11-09","epss":0.00549,"percentile":0.46257}],"urls":["https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/security/cve/CVE-2026-46384","https://bugzilla.redhat.com/show_bug.cgi?id=2483482","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46384.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46384","description":"iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets (GOARCH=386, arm, mips, wasm, etc.), the truncation paths can silently bypass byte-slice limits, select the wrong union branch, or hit the OCF negative-make panic via wrap. Three sub-issues are not 32-bit-specific: cumulative-size arithmetic overflow in arrayDecoder.Decode / mapDecoder.Decode / mapDecoderUnmarshaler.Decode (wraps at math.MaxInt64 on amd64 / arm64 and bypasses MaxSliceAllocSize / MaxMapAllocSize), math.MinInt negation in block-header handling, and make([]byte, size) with a negative size in OCF block reads — all three panic or bypass caps on any platform, giving an attacker a denial-of-service primitive there. This vulnerability is fixed in 2.33.0."},{"id":"GHSA-mc57-h6j3-3hmv","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46384","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-46384","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-46384","date":"2026-11-09","epss":0.00549,"percentile":0.46257}],"urls":["https://github.com/iskorotkov/avro/security/advisories/GHSA-mc57-h6j3-3hmv","https://nvd.nist.gov/vuln/detail/CVE-2026-46384"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-mc57-h6j3-3hmv","description":"iskorotkov/avro: Integer Overflow in Decoder"}]},{"artifact":{"id":"9d1cb2cb6f22731c","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.39-3ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.39-3ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.39-3ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.39-3ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.39-3ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.39-3ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.39-3ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.39-3ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.39-3ubuntu0.2:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.39-3ubuntu0.2:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.39-3ubuntu0.2?arch=amd64&distro=ubuntu-22.04&upstream=pcre2","type":"deb","version":"10.39-3ubuntu0.2","language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-41409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre2","version":"10.39-3ubuntu0.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-41409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-09","epss":0.01121,"percentile":0.66421}],"risk":0.3363,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-41409"},"relatedVulnerabilities":[{"id":"CVE-2022-41409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-09","epss":0.01121,"percentile":0.66421}],"urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."}]},{"artifact":{"id":"e055751ea35a0539","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.10?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.10","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-09","epss":0.0063,"percentile":0.50465}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-09","epss":0.0063,"percentile":0.50465}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"73bfee6977909c70","cpes":["cpe:2.3:a:libncurses6:libncurses6:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libncurses6","purl":"pkg:deb/ubuntu/libncurses6@6.3-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=ncurses","type":"deb","version":"6.3-2ubuntu0.3","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libncurses6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"8e007cea28d5fe14","cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libncursesw6","purl":"pkg:deb/ubuntu/libncursesw6@6.3-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=ncurses","type":"deb","version":"6.3-2ubuntu0.3","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"6688ea0ddea16b97","cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libtinfo6","purl":"pkg:deb/ubuntu/libtinfo6@6.3-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=ncurses","type":"deb","version":"6.3-2ubuntu0.3","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"e9bc1df82019e1fd","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/ubuntu/ncurses-base@6.3-2ubuntu0.3?arch=all&distro=ubuntu-22.04&upstream=ncurses","type":"deb","version":"6.3-2ubuntu0.3","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"5f1d0ed19a265f2f","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.3-2ubuntu0.3:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/ubuntu/ncurses-bin@6.3-2ubuntu0.3?arch=amd64&distro=ubuntu-22.04&upstream=ncurses","type":"deb","version":"6.3-2ubuntu0.3","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"ncurses","version":"6.3-2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-09","epss":0.01037,"percentile":0.64153}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"8d28dbebf50a50bb","cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.60.0","type":"go-module","version":"v0.60.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/lib/libmilvus-planparser.so","layerID":"sha256:3656e3c7ecc57218ee32c4319d8ed51bc8687be2c866b2bf6a3c099f2bee9519","accessPath":"/milvus/lib/libmilvus-planparser.so","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.62.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.60.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6860","fix":{"state":"fixed","versions":["0.62.0"],"available":[{"date":"2026-10-27","kind":"release","version":"0.62.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78661","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78661","date":"2026-11-09","epss":0.00409,"percentile":0.3543}],"risk":0.30674999999999997,"urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/849365","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse."},"relatedVulnerabilities":[{"id":"CVE-2026-78661","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78661","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78661","date":"2026-11-09","epss":0.00409,"percentile":0.3543}],"urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse."}]},{"artifact":{"id":"bcf8cbaf5280d010","cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.60.0","type":"go-module","version":"v0.60.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.62.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.60.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6860","fix":{"state":"fixed","versions":["0.62.0"],"available":[{"date":"2026-10-27","kind":"release","version":"0.62.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78661","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78661","date":"2026-11-09","epss":0.00409,"percentile":0.3543}],"risk":0.30674999999999997,"urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/849365","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse."},"relatedVulnerabilities":[{"id":"CVE-2026-78661","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78661","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78661","date":"2026-11-09","epss":0.00409,"percentile":0.3543}],"urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse."}]},{"artifact":{"id":"28fca543f57dcd6c","cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"gcc-12-base","purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-09","epss":0.00953,"percentile":0.61588}],"risk":0.2859,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-27943"},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-09","epss":0.00953,"percentile":0.61588}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"8b00bd78062b4cf6","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-09","epss":0.00953,"percentile":0.61588}],"risk":0.2859,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-27943"},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-09","epss":0.00953,"percentile":0.61588}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"460ba69fd84f6da5","cpes":["cpe:2.3:a:libgomp1:libgomp1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/ubuntu/libgomp1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-09","epss":0.00953,"percentile":0.61588}],"risk":0.2859,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-27943"},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-09","epss":0.00953,"percentile":0.61588}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"68ba2921acfec6fe","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-27943","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-09","epss":0.00953,"percentile":0.61588}],"risk":0.2859,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-27943"},"relatedVulnerabilities":[{"id":"CVE-2022-27943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-27943","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-27943","date":"2026-11-09","epss":0.00953,"percentile":0.61588}],"urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."}]},{"artifact":{"id":"e74700d51b4959b7","cpes":["cpe:2.3:a:apache:thrift:v0.24.0:*:*:*:*:*:*:*"],"name":"github.com/apache/thrift","purl":"pkg:golang/github.com/apache/thrift@v0.24.0","type":"go-module","version":"v0.24.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.25.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82458","versionConstraint":"< 0.25.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/apache/thrift","version":"v0.24.0"},"language":"go","namespace":"nvd:language:go"}}],"vulnerability":{"id":"CVE-2026-82458","fix":{"state":"fixed","versions":["0.25.0"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"0.25.0"}]},"cvss":[{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82458","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2026-82458","cwe":"CWE-789","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-82458","date":"2026-11-09","epss":0.00342,"percentile":0.27941}],"risk":0.27701999999999993,"urls":["https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1","https://lists.apache.org/thread/7xqf651pvjykw0xr9vw0ooz0bwx7wzy7"],"severity":"High","namespace":"nvd:language:go","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82458","description":"Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings.\n\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"e055751ea35a0539","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.10?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.10","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-09","epss":0.00553,"percentile":0.4649}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-09","epss":0.00553,"percentile":0.4649}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"ff245a5c07c10f02","cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"name":"github.com/go-jose/go-jose/v4","purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","type":"go-module","version":"v4.1.4","language":"go","licenses":[],"metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mgcc-cww5-fp2q","versionConstraint":"<=4.1.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-mgcc-cww5-fp2q","fix":{"state":"fixed","versions":["4.1.6"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"4.1.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-116587","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116587","date":"2026-11-09","epss":0.00366,"percentile":0.30694}],"risk":0.2745,"urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116587","https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mgcc-cww5-fp2q","description":"Go JOSE: DoS when parsing JWKs that contain RSA keys"},"relatedVulnerabilities":[{"id":"CVE-2026-116587","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-116587","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116587","date":"2026-11-09","epss":0.00366,"percentile":0.30694}],"urls":["https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6","https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116587","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6."}]},{"artifact":{"id":"ec0b576f16436933","cpes":["cpe:2.3:a:klauspost:compress:v1.18.7:*:*:*:*:*:*:*"],"name":"github.com/klauspost/compress","purl":"pkg:golang/github.com/klauspost/compress@v1.18.7","type":"go-module","version":"v1.18.7","language":"go","licenses":[],"metadata":{"h1Digest":"h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/lib/libmilvus-planparser.so","layerID":"sha256:3656e3c7ecc57218ee32c4319d8ed51bc8687be2c866b2bf6a3c099f2bee9519","accessPath":"/milvus/lib/libmilvus-planparser.so","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6865","versionConstraint":"<1.20.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/klauspost/compress","version":"v1.18.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6865","fix":{"state":"fixed","versions":["1.20.2"],"available":[{"date":"2026-10-12","kind":"release","version":"1.20.2"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116591","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116591","date":"2026-11-09","epss":0.00333,"percentile":0.26668}],"risk":0.26972999999999997,"urls":["https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d","https://github.com/klauspost/compress/releases/tag/v1.20.2"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8","description":"Panic on two-block frames in github.com/klauspost/compress"},"relatedVulnerabilities":[{"id":"CVE-2026-116591","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116591","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116591","date":"2026-11-09","epss":0.00333,"percentile":0.26668}],"urls":["https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d","https://github.com/klauspost/compress/releases/tag/v1.20.2","https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116591","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2."},{"id":"GHSA-fpmh-frq8-7rj8","cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116591","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116591","date":"2026-11-09","epss":0.00333,"percentile":0.26668}],"urls":["https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8","https://nvd.nist.gov/vuln/detail/CVE-2026-116591","https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d","https://github.com/klauspost/compress/releases/tag/v1.20.2"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-fpmh-frq8-7rj8","description":"compress zstd: Panic on two-block frames"}]},{"artifact":{"id":"fe28e6e965f0e15d","cpes":["cpe:2.3:a:klauspost:compress:v1.18.7:*:*:*:*:*:*:*"],"name":"github.com/klauspost/compress","purl":"pkg:golang/github.com/klauspost/compress@v1.18.7","type":"go-module","version":"v1.18.7","language":"go","licenses":[],"metadata":{"h1Digest":"h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.20.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6865","versionConstraint":"<1.20.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/klauspost/compress","version":"v1.18.7"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6865","fix":{"state":"fixed","versions":["1.20.2"],"available":[{"date":"2026-10-12","kind":"release","version":"1.20.2"}]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116591","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116591","date":"2026-11-09","epss":0.00333,"percentile":0.26668}],"risk":0.26972999999999997,"urls":["https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d","https://github.com/klauspost/compress/releases/tag/v1.20.2"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8","description":"Panic on two-block frames in github.com/klauspost/compress"},"relatedVulnerabilities":[{"id":"CVE-2026-116591","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116591","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116591","date":"2026-11-09","epss":0.00333,"percentile":0.26668}],"urls":["https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d","https://github.com/klauspost/compress/releases/tag/v1.20.2","https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116591","description":"compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in version 1.20.2."},{"id":"GHSA-fpmh-frq8-7rj8","cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116591","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116591","date":"2026-11-09","epss":0.00333,"percentile":0.26668}],"urls":["https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8","https://nvd.nist.gov/vuln/detail/CVE-2026-116591","https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d","https://github.com/klauspost/compress/releases/tag/v1.20.2"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-fpmh-frq8-7rj8","description":"compress zstd: Panic on two-block frames"}]},{"artifact":{"id":"eb5670f499fce275","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-09","epss":0.00521,"percentile":0.44511}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-09","epss":0.00521,"percentile":0.44511}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"9c5b68e24195b0fe","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-09","epss":0.00521,"percentile":0.44511}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-09","epss":0.00521,"percentile":0.44511}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"21bbab564efb25fa","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-09","epss":0.00521,"percentile":0.44511}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-09","epss":0.00521,"percentile":0.44511}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"c66a2d80d8f2743c","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-09","epss":0.00521,"percentile":0.44511}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-09","epss":0.00521,"percentile":0.44511}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"e055751ea35a0539","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.10?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.10","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-09","epss":0.00517,"percentile":0.44292}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-09","epss":0.00517,"percentile":0.44292}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"e74700d51b4959b7","cpes":["cpe:2.3:a:apache:thrift:v0.24.0:*:*:*:*:*:*:*"],"name":"github.com/apache/thrift","purl":"pkg:golang/github.com/apache/thrift@v0.24.0","type":"go-module","version":"v0.24.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.25.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63772","versionConstraint":"< 0.25.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/apache/thrift","version":"v0.24.0"},"language":"go","namespace":"nvd:language:go"}}],"vulnerability":{"id":"CVE-2026-63772","fix":{"state":"fixed","versions":["0.25.0"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"0.25.0"}]},"cvss":[{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63772","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63772","date":"2026-11-09","epss":0.00316,"percentile":0.24687}],"risk":0.25596,"urls":["https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1","https://lists.apache.org/thread/6kpzdw29gsfxptv4b65y9s6f42tdyo8k"],"severity":"High","namespace":"nvd:language:go","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63772","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"d6866d996aec27de","cpes":["cpe:2.3:a:golang:go:1.26.9:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.9","type":"go-module","version":"go1.26.9","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6809","versionConstraint":"<1.26.10||>=1.27.0-0,<1.27.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.9"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6809","fix":{"state":"fixed","versions":["1.26.10","1.27.3"],"available":[{"date":"2026-10-20","kind":"release","version":"1.26.10"},{"date":"2026-10-20","kind":"release","version":"1.27.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111943","cwe":"CWE-299","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-111943","date":"2026-11-09","epss":0.00396,"percentile":0.34049}],"risk":0.23364,"urls":["https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/851047","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.\n\nTo defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."},"relatedVulnerabilities":[{"id":"CVE-2026-111943","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111943","cwe":"CWE-299","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-111943","date":"2026-11-09","epss":0.00396,"percentile":0.34049}],"urls":["https://go.dev/cl/851047","https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek","https://pkg.go.dev/vuln/GO-2026-6809","http://www.openwall.com/lists/oss-security/2026/10/20/29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111943","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."}]},{"artifact":{"id":"9812dcf20a8b4de3","cpes":["cpe:2.3:a:golang:go:1.26.9:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.9","type":"go-module","version":"go1.26.9","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/lib/libmilvus-planparser.so","layerID":"sha256:3656e3c7ecc57218ee32c4319d8ed51bc8687be2c866b2bf6a3c099f2bee9519","accessPath":"/milvus/lib/libmilvus-planparser.so","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6809","versionConstraint":"<1.26.10||>=1.27.0-0,<1.27.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.9"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6809","fix":{"state":"fixed","versions":["1.26.10","1.27.3"],"available":[{"date":"2026-10-20","kind":"release","version":"1.26.10"},{"date":"2026-10-20","kind":"release","version":"1.27.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111943","cwe":"CWE-299","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-111943","date":"2026-11-09","epss":0.00396,"percentile":0.34049}],"risk":0.23364,"urls":["https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/851047","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.\n\nTo defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."},"relatedVulnerabilities":[{"id":"CVE-2026-111943","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111943","cwe":"CWE-299","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-111943","date":"2026-11-09","epss":0.00396,"percentile":0.34049}],"urls":["https://go.dev/cl/851047","https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek","https://pkg.go.dev/vuln/GO-2026-6809","http://www.openwall.com/lists/oss-security/2026/10/20/29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111943","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."}]},{"artifact":{"id":"e74700d51b4959b7","cpes":["cpe:2.3:a:apache:thrift:v0.24.0:*:*:*:*:*:*:*"],"name":"github.com/apache/thrift","purl":"pkg:golang/github.com/apache/thrift@v0.24.0","type":"go-module","version":"v0.24.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.25.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-83663","versionConstraint":"< 0.25.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/apache/thrift","version":"v0.24.0"},"language":"go","namespace":"nvd:language:go"}}],"vulnerability":{"id":"CVE-2026-83663","fix":{"state":"fixed","versions":["0.25.0"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"0.25.0"}]},"cvss":[{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83663","cwe":"CWE-674","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-83663","date":"2026-11-09","epss":0.00277,"percentile":0.20311}],"risk":0.22436999999999999,"urls":["https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1","https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct"],"severity":"High","namespace":"nvd:language:go","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83663","description":"Uncontrolled Recursion vulnerability in Apache Thrift go bindings.\n\n\n\nBoth Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"28fca543f57dcd6c","cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"gcc-12-base","purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-09","epss":0.00444,"percentile":0.38869}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-09","epss":0.00444,"percentile":0.38869}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"8b00bd78062b4cf6","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-09","epss":0.00444,"percentile":0.38869}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-09","epss":0.00444,"percentile":0.38869}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"460ba69fd84f6da5","cpes":["cpe:2.3:a:libgomp1:libgomp1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/ubuntu/libgomp1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-09","epss":0.00444,"percentile":0.38869}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-09","epss":0.00444,"percentile":0.38869}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"68ba2921acfec6fe","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-09","epss":0.00444,"percentile":0.38869}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-09","epss":0.00444,"percentile":0.38869}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"e055751ea35a0539","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.10?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.10","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-09","epss":0.00439,"percentile":0.38461}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-09","epss":0.00439,"percentile":0.38461}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"e74700d51b4959b7","cpes":["cpe:2.3:a:apache:thrift:v0.24.0:*:*:*:*:*:*:*"],"name":"github.com/apache/thrift","purl":"pkg:golang/github.com/apache/thrift@v0.24.0","type":"go-module","version":"v0.24.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.25.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-66055","versionConstraint":"< 0.25.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/apache/thrift","version":"v0.24.0"},"language":"go","namespace":"nvd:language:go"}}],"vulnerability":{"id":"CVE-2026-66055","fix":{"state":"fixed","versions":["0.25.0"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"0.25.0"}]},"cvss":[{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66055","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-66055","date":"2026-11-09","epss":0.00277,"percentile":0.20311}],"risk":0.21744499999999997,"urls":["https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1","https://lists.apache.org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcx"],"severity":"High","namespace":"nvd:language:go","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66055","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"e74700d51b4959b7","cpes":["cpe:2.3:a:apache:thrift:v0.24.0:*:*:*:*:*:*:*"],"name":"github.com/apache/thrift","purl":"pkg:golang/github.com/apache/thrift@v0.24.0","type":"go-module","version":"v0.24.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.25.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94637","versionConstraint":"< 0.25.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/apache/thrift","version":"v0.24.0"},"language":"go","namespace":"nvd:language:go"}}],"vulnerability":{"id":"CVE-2026-94637","fix":{"state":"fixed","versions":["0.25.0"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"0.25.0"}]},"cvss":[{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94637","cwe":"CWE-409","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-94637","date":"2026-11-09","epss":0.00277,"percentile":0.20309}],"risk":0.21744499999999997,"urls":["https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1","https://lists.apache.org/thread/6hxll1jcnod9gfr225tz7my08lpj3jmt"],"severity":"High","namespace":"nvd:language:go","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94637","description":"Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings.\n\n\n\nThis issue affects Apache Thrift: before 0.25.0.\n\n\n\nUsers are recommended to upgrade to version 0.25.0, which fixes the issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"2d995e9dbc2ddbc0","cpes":["cpe:2.3:a:dirmngr:dirmngr:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"dirmngr","purl":"pkg:deb/ubuntu/dirmngr@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dirmngr/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/dirmngr/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.list"},{"path":"/var/lib/dpkg/info/dirmngr.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.postinst"},{"path":"/var/lib/dpkg/info/dirmngr.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.postrm"},{"path":"/var/lib/dpkg/info/dirmngr.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.preinst"},{"path":"/var/lib/dpkg/info/dirmngr.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.prerm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"87d85fc31d97759c","cpes":["cpe:2.3:a:gnupg:gnupg:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/ubuntu/gnupg@2.2.27-3ubuntu2.5?arch=all&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"21e433471ebcdd4c","cpes":["cpe:2.3:a:gnupg-l10n:gnupg-l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-l10n:gnupg_l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg-l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg_l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg-l10n","purl":"pkg:deb/ubuntu/gnupg-l10n@2.2.27-3ubuntu2.5?arch=all&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-l10n/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-l10n.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"4da066024d6bd485","cpes":["cpe:2.3:a:gnupg-utils:gnupg-utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-utils:gnupg_utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg-utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg_utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg-utils","purl":"pkg:deb/ubuntu/gnupg-utils@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-utils/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-utils.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"be7029cb13ed57af","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:deb/ubuntu/gnupg2@2.2.27-3ubuntu2.5?arch=all&distro=ubuntu-22.04","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg2/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg2.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg2.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg2.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"ac02a22afc1598d4","cpes":["cpe:2.3:a:gpg:gpg:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg","purl":"pkg:deb/ubuntu/gpg@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"77792b77bb0fcaba","cpes":["cpe:2.3:a:gpg-agent:gpg-agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-agent:gpg_agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg-agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg_agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg-agent","purl":"pkg:deb/ubuntu/gpg-agent@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-agent/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg-agent/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.list"},{"path":"/var/lib/dpkg/info/gpg-agent.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.postinst"},{"path":"/var/lib/dpkg/info/gpg-agent.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.postrm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"fe3c51f7337154a3","cpes":["cpe:2.3:a:gpg-wks-client:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks-client:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_client:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_client:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg-wks-client","purl":"pkg:deb/ubuntu/gpg-wks-client@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-wks-client/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg-wks-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-client.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-client.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-client.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"bf862e676a9f55f3","cpes":["cpe:2.3:a:gpg-wks-server:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks-server:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_server:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_server:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg-wks-server","purl":"pkg:deb/ubuntu/gpg-wks-server@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-wks-server/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg-wks-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-server.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-server.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-server.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"5c6a194c9301a444","cpes":["cpe:2.3:a:gpgconf:gpgconf:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpgconf","purl":"pkg:deb/ubuntu/gpgconf@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgconf/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpgconf/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgconf.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgconf.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"5e7058fe04099641","cpes":["cpe:2.3:a:gpgsm:gpgsm:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpgsm","purl":"pkg:deb/ubuntu/gpgsm@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgsm/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpgsm/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgsm.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgsm.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"2551cbcb93b2aea5","cpes":["cpe:2.3:a:gpgv:gpgv:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118131","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-118131","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118131"},"relatedVulnerabilities":[{"id":"CVE-2026-118131","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118131","cwe":"CWE-379","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-427","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-118131","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118131","date":"2026-11-09","epss":0.0043,"percentile":0.37514}],"urls":["https://atos.net/en/lp/cybershield/a-tale-of-several-hijacks-and-what-it-taught-me-about-runtime-driven-testing"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118131","description":"GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\\ProgramData directory allows members of the BUILTIN\\Users group to create arbitrary subdirectories under this path. An attacker with low-privilege access can create the expected GnuPG configuration directory and inject malicious configuration files consumed by GnuPG components. This can result in code execution within the security context of the victim user."}]},{"artifact":{"id":"eb5670f499fce275","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-09","epss":0.00424,"percentile":0.36992}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-09","epss":0.00424,"percentile":0.36992}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"9c5b68e24195b0fe","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-09","epss":0.00424,"percentile":0.36992}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-09","epss":0.00424,"percentile":0.36992}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"21bbab564efb25fa","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-09","epss":0.00424,"percentile":0.36992}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-09","epss":0.00424,"percentile":0.36992}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"c66a2d80d8f2743c","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-09","epss":0.00424,"percentile":0.36992}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-09","epss":0.00424,"percentile":0.36992}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"df9a817b3a9aa35b","cpes":["cpe:2.3:a:libtirpc-common:libtirpc-common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc-common:libtirpc_common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc-common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc_common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc-common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc_common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*"],"name":"libtirpc-common","purl":"pkg:deb/ubuntu/libtirpc-common@1.3.2-2ubuntu0.1?arch=all&distro=ubuntu-22.04&upstream=libtirpc","type":"deb","version":"1.3.2-2ubuntu0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc-common/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/libtirpc-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.conffiles","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libtirpc-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libtirpc-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.list","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libtirpc-common.list"}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtirpc","version":"1.3.2-2ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-09","epss":0.0042,"percentile":0.36619}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85977"},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-09","epss":0.0042,"percentile":0.36619}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"5547b4e7ac45ea0d","cpes":["cpe:2.3:a:libtirpc3:libtirpc3:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*"],"name":"libtirpc3","purl":"pkg:deb/ubuntu/libtirpc3@1.3.2-2ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=libtirpc","type":"deb","version":"1.3.2-2ubuntu0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc3/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/libtirpc3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc3:amd64.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libtirpc3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtirpc","version":"1.3.2-2ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-09","epss":0.0042,"percentile":0.36619}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85977"},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-11-09","epss":0.0042,"percentile":0.36619}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"28fca543f57dcd6c","cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"gcc-12-base","purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-09","epss":0.00395,"percentile":0.33954}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114691"},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-09","epss":0.00395,"percentile":0.33954}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"8b00bd78062b4cf6","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-09","epss":0.00395,"percentile":0.33954}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114691"},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-09","epss":0.00395,"percentile":0.33954}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"460ba69fd84f6da5","cpes":["cpe:2.3:a:libgomp1:libgomp1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/ubuntu/libgomp1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-09","epss":0.00395,"percentile":0.33954}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114691"},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-09","epss":0.00395,"percentile":0.33954}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"68ba2921acfec6fe","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-09","epss":0.00395,"percentile":0.33954}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114691"},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-09","epss":0.00395,"percentile":0.33954}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"60a5c7d4d13f457c","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/ubuntu/libsasl2-2@2.1.27%2Bdfsg2-3ubuntu1.2?arch=amd64&distro=ubuntu-22.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.27+dfsg2-3ubuntu1.2","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","OpenSSL","RSA-MD","SSLeay"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:b5e294e75ffe843434721e036fd14b2ac9323ec7e3fd6d5daa4ab18009e8f2ef","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:b5e294e75ffe843434721e036fd14b2ac9323ec7e3fd6d5daa4ab18009e8f2ef","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"cyrus-sasl2","version":"2.1.27+dfsg2-3ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-09","epss":0.00376,"percentile":0.31828}],"risk":0.188,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-09","epss":0.00376,"percentile":0.31828}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20","https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"8abab1d91ea34ca6","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.27\\+dfsg2-3ubuntu1.2:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/ubuntu/libsasl2-modules-db@2.1.27%2Bdfsg2-3ubuntu1.2?arch=amd64&distro=ubuntu-22.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.27+dfsg2-3ubuntu1.2","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","OpenSSL","RSA-MD","SSLeay"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:b5e294e75ffe843434721e036fd14b2ac9323ec7e3fd6d5daa4ab18009e8f2ef","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:b5e294e75ffe843434721e036fd14b2ac9323ec7e3fd6d5daa4ab18009e8f2ef","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"cyrus-sasl2","version":"2.1.27+dfsg2-3ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-09","epss":0.00376,"percentile":0.31828}],"risk":0.188,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-11-09","epss":0.00376,"percentile":0.31828}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20","https://lists.debian.org/debian-lts-announce/2026/10/msg00064.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"e055751ea35a0539","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.10?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.10","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-09","epss":0.00349,"percentile":0.28713}],"risk":0.1745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-09","epss":0.00349,"percentile":0.28713}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"28fca543f57dcd6c","cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"gcc-12-base","purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-09","epss":0.00348,"percentile":0.28662}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-09","epss":0.00348,"percentile":0.28662}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"8b00bd78062b4cf6","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-09","epss":0.00348,"percentile":0.28662}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-09","epss":0.00348,"percentile":0.28662}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"460ba69fd84f6da5","cpes":["cpe:2.3:a:libgomp1:libgomp1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/ubuntu/libgomp1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-09","epss":0.00348,"percentile":0.28662}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-09","epss":0.00348,"percentile":0.28662}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"68ba2921acfec6fe","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-09","epss":0.00348,"percentile":0.28662}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-09","epss":0.00348,"percentile":0.28662}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"ff245a5c07c10f02","cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"name":"github.com/go-jose/go-jose/v4","purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","type":"go-module","version":"v4.1.4","language":"go","licenses":[],"metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vvm8-gf78-28g4","versionConstraint":"<4.1.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-vvm8-gf78-28g4","fix":{"state":"fixed","versions":["4.1.5"],"available":[{"date":"2026-10-29","kind":"first-observed","version":"4.1.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116586","date":"2026-11-09","epss":0.00292,"percentile":0.21891}],"risk":0.17373999999999998,"urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4","https://nvd.nist.gov/vuln/detail/CVE-2026-116586","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vvm8-gf78-28g4","description":"Go JOSE: Panics in JSON parsing"},"relatedVulnerabilities":[{"id":"CVE-2026-116586","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116586","date":"2026-11-09","epss":0.00292,"percentile":0.21891}],"urls":["https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116586","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5."}]},{"artifact":{"id":"ff245a5c07c10f02","cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.4:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.4:*:*:*:*:*:*:*"],"name":"github.com/go-jose/go-jose/v4","purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4","type":"go-module","version":"v4.1.4","language":"go","licenses":[],"metadata":{"h1Digest":"h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4w3g-jfj2-cw2q","versionConstraint":"<4.1.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.4"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-4w3g-jfj2-cw2q","fix":{"state":"fixed","versions":["4.1.5"],"available":[{"date":"2026-10-29","kind":"first-observed","version":"4.1.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116585","date":"2026-11-09","epss":0.00264,"percentile":0.18422}],"risk":0.15708,"urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116585","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4w3g-jfj2-cw2q","description":"Go JOSE: Panic during CBC-HMAC processing"},"relatedVulnerabilities":[{"id":"CVE-2026-116585","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-116585","date":"2026-11-09","epss":0.00264,"percentile":0.18422}],"urls":["https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116585","description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5."}]},{"artifact":{"id":"28fca543f57dcd6c","cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"gcc-12-base","purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-09","epss":0.00314,"percentile":0.24457}],"risk":0.157,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115455"},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-09","epss":0.00314,"percentile":0.24457}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"8b00bd78062b4cf6","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-09","epss":0.00314,"percentile":0.24457}],"risk":0.157,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115455"},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-09","epss":0.00314,"percentile":0.24457}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"460ba69fd84f6da5","cpes":["cpe:2.3:a:libgomp1:libgomp1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/ubuntu/libgomp1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-09","epss":0.00314,"percentile":0.24457}],"risk":0.157,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115455"},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-09","epss":0.00314,"percentile":0.24457}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"68ba2921acfec6fe","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-09","epss":0.00314,"percentile":0.24457}],"risk":0.157,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115455"},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-09","epss":0.00314,"percentile":0.24457}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"a1080f742c38e287","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.39-13ubuntu0.22.04.1:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/ubuntu/libpcre3@2%3A8.39-13ubuntu0.22.04.1?arch=amd64&distro=ubuntu-22.04&upstream=pcre3","type":"deb","version":"2:8.39-13ubuntu0.22.04.1","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-11164","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pcre3","version":"2:8.39-13ubuntu0.22.04.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2017-11164","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-11164","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11164","date":"2026-11-09","epss":0.03076,"percentile":0.87757}],"risk":0.15380000000000002,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-11164"},"relatedVulnerabilities":[{"id":"CVE-2017-11164","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-11164","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-11164","date":"2026-11-09","epss":0.03076,"percentile":0.87757}],"urls":["http://openwall.com/lists/oss-security/2017/07/11/3","http://www.openwall.com/lists/oss-security/2023/04/11/1","http://www.openwall.com/lists/oss-security/2023/04/12/1","http://www.securityfocus.com/bid/99575","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-11164","description":"In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression."}]},{"artifact":{"id":"410ae421412cce83","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.15","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-09","epss":0.00297,"percentile":0.22583}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-09","epss":0.00297,"percentile":0.22583}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"9338e29687b3d4ff","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.15","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84243","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-84243","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-09","epss":0.00297,"percentile":0.22583}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84243"},"relatedVulnerabilities":[{"id":"CVE-2026-84243","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84243","cwe":"CWE-22","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-84243","date":"2026-11-09","epss":0.00297,"percentile":0.22583}],"urls":["https://inbox.sourceware.org/libc-alpha/20261012112453.47383-1-avinal.xlvii@gmail.com","https://sourceware.org/bugzilla/show_bug.cgi?id=17142","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84243","description":"The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.\n\nThe fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.\n\nLANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.<encoding>\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."}]},{"artifact":{"id":"df9a817b3a9aa35b","cpes":["cpe:2.3:a:libtirpc-common:libtirpc-common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc-common:libtirpc_common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc-common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc_common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc-common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc_common:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*"],"name":"libtirpc-common","purl":"pkg:deb/ubuntu/libtirpc-common@1.3.2-2ubuntu0.1?arch=all&distro=ubuntu-22.04&upstream=libtirpc","type":"deb","version":"1.3.2-2ubuntu0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc-common/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/libtirpc-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.conffiles","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libtirpc-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libtirpc-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.list","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libtirpc-common.list"}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtirpc","version":"1.3.2-2ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-09","epss":0.00297,"percentile":0.22525}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85231"},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-09","epss":0.00297,"percentile":0.22525}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"5547b4e7ac45ea0d","cpes":["cpe:2.3:a:libtirpc3:libtirpc3:1.3.2-2ubuntu0.1:*:*:*:*:*:*:*"],"name":"libtirpc3","purl":"pkg:deb/ubuntu/libtirpc3@1.3.2-2ubuntu0.1?arch=amd64&distro=ubuntu-22.04&upstream=libtirpc","type":"deb","version":"1.3.2-2ubuntu0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc3/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/libtirpc3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc3:amd64.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libtirpc3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"libtirpc","version":"1.3.2-2ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-09","epss":0.00297,"percentile":0.22525}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85231"},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-11-09","epss":0.00297,"percentile":0.22525}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"bcf8cbaf5280d010","cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.60.0","type":"go-module","version":"v0.60.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.62.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.60.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6866","fix":{"state":"fixed","versions":["0.62.0"],"available":[{"date":"2026-10-27","kind":"release","version":"0.62.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97045","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97045","date":"2026-11-09","epss":0.00267,"percentile":0.18966}],"risk":0.14818499999999998,"urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/855121","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text."},"relatedVulnerabilities":[{"id":"CVE-2026-97045","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97045","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97045","date":"2026-11-09","epss":0.00267,"percentile":0.18966}],"urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text."}]},{"artifact":{"id":"8d28dbebf50a50bb","cpes":["cpe:2.3:a:golang:networking:v0.60.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.60.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.60.0","type":"go-module","version":"v0.60.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/lib/libmilvus-planparser.so","layerID":"sha256:3656e3c7ecc57218ee32c4319d8ed51bc8687be2c866b2bf6a3c099f2bee9519","accessPath":"/milvus/lib/libmilvus-planparser.so","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.62.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.60.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6866","fix":{"state":"fixed","versions":["0.62.0"],"available":[{"date":"2026-10-27","kind":"release","version":"0.62.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97045","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97045","date":"2026-11-09","epss":0.00267,"percentile":0.18966}],"risk":0.14818499999999998,"urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/855121","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text."},"relatedVulnerabilities":[{"id":"CVE-2026-97045","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97045","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97045","date":"2026-11-09","epss":0.00267,"percentile":0.18966}],"urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text."}]},{"artifact":{"id":"410ae421412cce83","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.15","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-09","epss":0.00281,"percentile":0.20737}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-09","epss":0.00281,"percentile":0.20737}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"9338e29687b3d4ff","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.15","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-09","epss":0.00281,"percentile":0.20737}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-11-09","epss":0.00281,"percentile":0.20737}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-09","epss":0.00278,"percentile":0.20407}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119379"},"relatedVulnerabilities":[{"id":"CVE-2026-119379","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-09","epss":0.00278,"percentile":0.20407}],"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."}]},{"artifact":{"id":"428f3f8eef9cc14d","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/ubuntu/libpam-modules@1.4.0-11ubuntu2.8?arch=amd64&distro=ubuntu-22.04&upstream=pam","type":"deb","version":"1.4.0-11ubuntu2.8","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pam","version":"1.4.0-11ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-09","epss":0.00265,"percentile":0.18518}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-09","epss":0.00265,"percentile":0.18518}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"ea33f476c4e81a19","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/ubuntu/libpam-modules-bin@1.4.0-11ubuntu2.8?arch=amd64&distro=ubuntu-22.04&upstream=pam","type":"deb","version":"1.4.0-11ubuntu2.8","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pam","version":"1.4.0-11ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-09","epss":0.00265,"percentile":0.18518}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-09","epss":0.00265,"percentile":0.18518}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"0b8e24e3634075a2","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/ubuntu/libpam-runtime@1.4.0-11ubuntu2.8?arch=all&distro=ubuntu-22.04&upstream=pam","type":"deb","version":"1.4.0-11ubuntu2.8","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pam","version":"1.4.0-11ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-09","epss":0.00265,"percentile":0.18518}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-09","epss":0.00265,"percentile":0.18518}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"494aa21d86f9626e","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.4.0-11ubuntu2.8:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/ubuntu/libpam0g@1.4.0-11ubuntu2.8?arch=amd64&distro=ubuntu-22.04&upstream=pam","type":"deb","version":"1.4.0-11ubuntu2.8","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"pam","version":"1.4.0-11ubuntu2.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-09","epss":0.00265,"percentile":0.18518}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-11-09","epss":0.00265,"percentile":0.18518}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/686","https://github.com/linux-pam/linux-pam/pull/757"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"e055751ea35a0539","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.10?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.10","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-48961","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48961","cwe":"CWE-755","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48961","date":"2026-11-09","epss":0.00262,"percentile":0.18059}],"risk":0.131,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48961"},"relatedVulnerabilities":[{"id":"CVE-2026-48961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48961","cwe":"CWE-755","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48961","date":"2026-11-09","epss":0.00262,"percentile":0.18059}],"urls":["https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48961","description":"IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.\n\nWhen decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255.\n\nLibrary callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool."}]},{"artifact":{"id":"6ee4a8495ea948b6","cpes":["cpe:2.3:a:coreutils:coreutils:8.32-4.1ubuntu1.4:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/ubuntu/coreutils@8.32-4.1ubuntu1.4?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"8.32-4.1ubuntu1.4","language":"","licenses":["BSD-3-Clause","GFDL-1.2-no-invariants-or-later","GPL-3.0-or-later","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/coreutils.list"},{"path":"/var/lib/dpkg/info/coreutils.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/coreutils.postinst"},{"path":"/var/lib/dpkg/info/coreutils.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/coreutils.postrm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"coreutils","version":"8.32-4.1ubuntu1.4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-09","epss":0.00428,"percentile":0.37324}],"risk":0.1284,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2781"},"relatedVulnerabilities":[{"id":"CVE-2016-2781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-09","epss":0.00428,"percentile":0.37324}],"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."}]},{"artifact":{"id":"5b68c464321b183f","cpes":["cpe:2.3:a:login:login:1\\:4.8.1-2ubuntu2.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.8.1-2ubuntu2.2?arch=amd64&distro=ubuntu-22.04&upstream=shadow","type":"deb","version":"1:4.8.1-2ubuntu2.2","language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"shadow","version":"1:4.8.1-2ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-09","epss":0.00426,"percentile":0.37177}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-09","epss":0.00426,"percentile":0.37177}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"7a457c8f5c9ce2f6","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.8.1-2ubuntu2.2:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/ubuntu/passwd@1%3A4.8.1-2ubuntu2.2?arch=amd64&distro=ubuntu-22.04&upstream=shadow","type":"deb","version":"1:4.8.1-2ubuntu2.2","language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"shadow","version":"1:4.8.1-2ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-09","epss":0.00426,"percentile":0.37177}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-11-09","epss":0.00426,"percentile":0.37177}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"5b68c464321b183f","cpes":["cpe:2.3:a:login:login:1\\:4.8.1-2ubuntu2.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.8.1-2ubuntu2.2?arch=amd64&distro=ubuntu-22.04&upstream=shadow","type":"deb","version":"1:4.8.1-2ubuntu2.2","language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-29383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"shadow","version":"1:4.8.1-2ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-29383","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-29383","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-29383","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-29383","date":"2026-11-09","epss":0.00426,"percentile":0.37164}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-29383"},"relatedVulnerabilities":[{"id":"CVE-2023-29383","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-29383","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-29383","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-29383","date":"2026-11-09","epss":0.00426,"percentile":0.37164}],"urls":["https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d","https://github.com/shadow-maint/shadow/pull/687","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/","https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797","https://lists.debian.org/debian-lts-announce/2025/04/msg00026.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-29383","description":"In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account."}]},{"artifact":{"id":"7a457c8f5c9ce2f6","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.8.1-2ubuntu2.2:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/ubuntu/passwd@1%3A4.8.1-2ubuntu2.2?arch=amd64&distro=ubuntu-22.04&upstream=shadow","type":"deb","version":"1:4.8.1-2ubuntu2.2","language":"","licenses":["sha256:56ca9c00cdef4d69b35d2013465c539eb9e09a80fec538d0f6dc91423dbaa1d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-29383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"shadow","version":"1:4.8.1-2ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-29383","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-29383","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-29383","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-29383","date":"2026-11-09","epss":0.00426,"percentile":0.37164}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-29383"},"relatedVulnerabilities":[{"id":"CVE-2023-29383","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-29383","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-29383","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-29383","date":"2026-11-09","epss":0.00426,"percentile":0.37164}],"urls":["https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d","https://github.com/shadow-maint/shadow/pull/687","https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2023-29383-abusing-linux-chfn-to-misrepresent-etc-passwd/","https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=31797","https://lists.debian.org/debian-lts-announce/2025/04/msg00026.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-29383","description":"In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \\n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \\r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that \"cat /etc/passwd\" shows a rogue user account."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119378","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-09","epss":0.00251,"percentile":0.16532}],"risk":0.1255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119378"},"relatedVulnerabilities":[{"id":"CVE-2026-119378","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-09","epss":0.00251,"percentile":0.16532}],"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-23280","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-23280","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-23280","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23280","date":"2026-11-09","epss":0.00242,"percentile":0.15422}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-23280"},"relatedVulnerabilities":[{"id":"CVE-2025-23280","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-23280","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23280","date":"2026-11-09","epss":0.00242,"percentile":0.15422}],"urls":["https://nvidia.custhelp.com/app/answers/detail/a_id/5703","https://www.cve.org/CVERecord?id=CVE-2025-23280"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-23280","description":"NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}]},{"artifact":{"id":"c402b4f4f9225693","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.9:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.9","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88647","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-88647","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88647","date":"2026-11-09","epss":0.0024,"percentile":0.15142}],"risk":0.12,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88647"},"relatedVulnerabilities":[{"id":"CVE-2026-88647","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88647","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88647","date":"2026-11-09","epss":0.0024,"percentile":0.15142}],"urls":["https://gist.github.com/lkloliver/f98ec3de1a871fdfc02b70b8b9ba7642","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/issues/1802","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://github.com/lkloliver/poc/tree/main/CVE-2026-88647"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88647","description":"GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119374","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-09","epss":0.0023,"percentile":0.13915}],"risk":0.11499999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119374"},"relatedVulnerabilities":[{"id":"CVE-2026-119374","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-09","epss":0.0023,"percentile":0.13915}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-securedel","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/9cd4f9e920","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."}]},{"artifact":{"id":"28fca543f57dcd6c","cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"gcc-12-base","purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-115456","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-09","epss":0.00221,"percentile":0.12784}],"risk":0.11050000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115456"},"relatedVulnerabilities":[{"id":"CVE-2026-115456","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-09","epss":0.00221,"percentile":0.12784}],"urls":["https://access.redhat.com/security/cve/CVE-2026-115456","https://bugzilla.redhat.com/show_bug.cgi?id=2563044"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}]},{"artifact":{"id":"8b00bd78062b4cf6","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-115456","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-09","epss":0.00221,"percentile":0.12784}],"risk":0.11050000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115456"},"relatedVulnerabilities":[{"id":"CVE-2026-115456","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-09","epss":0.00221,"percentile":0.12784}],"urls":["https://access.redhat.com/security/cve/CVE-2026-115456","https://bugzilla.redhat.com/show_bug.cgi?id=2563044"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}]},{"artifact":{"id":"460ba69fd84f6da5","cpes":["cpe:2.3:a:libgomp1:libgomp1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/ubuntu/libgomp1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-115456","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-09","epss":0.00221,"percentile":0.12784}],"risk":0.11050000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115456"},"relatedVulnerabilities":[{"id":"CVE-2026-115456","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-09","epss":0.00221,"percentile":0.12784}],"urls":["https://access.redhat.com/security/cve/CVE-2026-115456","https://bugzilla.redhat.com/show_bug.cgi?id=2563044"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}]},{"artifact":{"id":"68ba2921acfec6fe","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-115456","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-09","epss":0.00221,"percentile":0.12784}],"risk":0.11050000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115456"},"relatedVulnerabilities":[{"id":"CVE-2026-115456","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115456","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115456","date":"2026-11-09","epss":0.00221,"percentile":0.12784}],"urls":["https://access.redhat.com/security/cve/CVE-2026-115456","https://bugzilla.redhat.com/show_bug.cgi?id=2563044"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115456","description":"A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."}]},{"artifact":{"id":"065d773192a6b192","cpes":["cpe:2.3:a:librtmp1:librtmp1:2.4\\+20151223.gitfa8646d.1-2build4:*:*:*:*:*:*:*"],"name":"librtmp1","purl":"pkg:deb/ubuntu/librtmp1@2.4%2B20151223.gitfa8646d.1-2build4?arch=amd64&distro=ubuntu-22.04&upstream=rtmpdump","type":"deb","version":"2.4+20151223.gitfa8646d.1-2build4","language":"","licenses":["sha256:4302abcc1ea1b6cbe8d19c79b892acf78878030220210707c19006828866207c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/librtmp1/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/librtmp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/librtmp1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/librtmp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"rtmpdump"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"rtmpdump","version":"2.4+20151223.gitfa8646d.1-2build4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-112061","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112061","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-112061","date":"2026-11-09","epss":0.00221,"percentile":0.12733}],"risk":0.11050000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112061"},"relatedVulnerabilities":[{"id":"CVE-2026-112061","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112061","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-112061","date":"2026-11-09","epss":0.00221,"percentile":0.12733}],"urls":["https://git.ffmpeg.org/gitweb/rtmpdump.git/blob/138fdb258d9fc26f1843fd1b891180416c9dc575:/librtmp/amf.c","https://hackmd.io/@haindpwn/librtmp-amf3-decode-and-strict-array-oob","https://rtmpdump.mplayerhq.hu/","https://www.vulncheck.com/advisories/librtmp-rtmpdump-through-2.6-heap-out-of-bounds-read-via-amfprop-decode"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112061","description":"librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24190","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24190","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24190","date":"2026-11-09","epss":0.00221,"percentile":0.12729}],"risk":0.11050000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24190"},"relatedVulnerabilities":[{"id":"CVE-2026-24190","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24190","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24190","date":"2026-11-09","epss":0.00221,"percentile":0.12729}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24190","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24190"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24190","description":"NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause improper access to GPU resources. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-23330","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-23330","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-23330","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23330","date":"2026-11-09","epss":0.00218,"percentile":0.12333}],"risk":0.109,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-23330"},"relatedVulnerabilities":[{"id":"CVE-2025-23330","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-23330","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23330","date":"2026-11-09","epss":0.00218,"percentile":0.12333}],"urls":["https://nvidia.custhelp.com/app/answers/detail/a_id/5703","https://www.cve.org/CVERecord?id=CVE-2025-23330"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-23330","description":"NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to trigger a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"410ae421412cce83","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.15","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2016-20013","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-11-09","epss":0.02174,"percentile":0.82437}],"risk":0.1087,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-20013"},"relatedVulnerabilities":[{"id":"CVE-2016-20013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-11-09","epss":0.02174,"percentile":0.82437}],"urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password."}]},{"artifact":{"id":"9338e29687b3d4ff","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.15","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2016-20013","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-11-09","epss":0.02174,"percentile":0.82437}],"risk":0.1087,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-20013"},"relatedVulnerabilities":[{"id":"CVE-2016-20013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-11-09","epss":0.02174,"percentile":0.82437}],"urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password."}]},{"artifact":{"id":"c402b4f4f9225693","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.9:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.9","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-95184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95184","date":"2026-11-09","epss":0.00208,"percentile":0.10935}],"risk":0.104,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95184"},"relatedVulnerabilities":[{"id":"CVE-2026-95184","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95184","date":"2026-11-09","epss":0.00208,"percentile":0.10935}],"urls":["https://gist.github.com/lkloliver/0c8b47fa75a0958fa88587665b82ae15","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://www.gnutls.org","https://github.com/lkloliver/poc/tree/main/CVE-2026-95184"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95184","description":"GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for \"EE O=Evil accepted although outside permitted O=Good.\" NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24192","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24192","cwe":"CWE-681","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24192","date":"2026-11-09","epss":0.00206,"percentile":0.10635}],"risk":0.10300000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24192"},"relatedVulnerabilities":[{"id":"CVE-2026-24192","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24192","cwe":"CWE-681","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24192","date":"2026-11-09","epss":0.00206,"percentile":0.10635}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24192","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24192","description":"NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause an incorrect conversion between numeric types, leading to a heap buffer overflow. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution."}]},{"artifact":{"id":"eb5670f499fce275","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-09","epss":0.02049,"percentile":0.81372}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5709"},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-09","epss":0.02049,"percentile":0.81372}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"9c5b68e24195b0fe","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-09","epss":0.02049,"percentile":0.81372}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5709"},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-09","epss":0.02049,"percentile":0.81372}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"21bbab564efb25fa","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-09","epss":0.02049,"percentile":0.81372}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5709"},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-09","epss":0.02049,"percentile":0.81372}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"c66a2d80d8f2743c","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.19.2-2ubuntu0.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.19.2-2ubuntu0.10?arch=amd64&distro=ubuntu-22.04&upstream=krb5","type":"deb","version":"1.19.2-2ubuntu0.10","language":"","licenses":["sha256:4a2d321ab57260e8de4b67bde8cff76c07d28be69c2d8b22dfc2bfa42f5c41b9"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"krb5","version":"1.19.2-2ubuntu0.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-09","epss":0.02049,"percentile":0.81372}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5709"},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-11-09","epss":0.02049,"percentile":0.81372}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-33219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-33219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-33219","cwe":"CWE-190","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-33219","date":"2026-11-09","epss":0.00204,"percentile":0.10445}],"risk":0.10200000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-33219"},"relatedVulnerabilities":[{"id":"CVE-2025-33219","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-33219","cwe":"CWE-190","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-33219","date":"2026-11-09","epss":0.00204,"percentile":0.10445}],"urls":["https://nvidia.custhelp.com/app/answers/detail/a_id/5747","https://www.cve.org/CVERecord?id=CVE-2025-33219"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-33219","description":"NVIDIA Display Driver for Linux contains a vulnerability in the NVIDIA kernel module where an attacker could cause an integer overflow or wraparound. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-33220","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-33220","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-33220","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-33220","date":"2026-11-09","epss":0.00203,"percentile":0.10272}],"risk":0.1015,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-33220"},"relatedVulnerabilities":[{"id":"CVE-2025-33220","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-33220","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-33220","date":"2026-11-09","epss":0.00203,"percentile":0.10272}],"urls":["https://nvidia.custhelp.com/app/answers/detail/a_id/5747","https://www.cve.org/CVERecord?id=CVE-2025-33220"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-33220","description":"NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, or information disclosure."}]},{"artifact":{"id":"c402b4f4f9225693","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.9:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.9","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88648","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-88648","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88648","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88648","date":"2026-11-09","epss":0.00202,"percentile":0.10241}],"risk":0.101,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88648"},"relatedVulnerabilities":[{"id":"CVE-2026-88648","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88648","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88648","date":"2026-11-09","epss":0.00202,"percentile":0.10241}],"urls":["https://gist.github.com/lkloliver/1f2a97cb8d0b31aa27b6bd0354358d7d","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10","https://www.rfc-editor.org/rfc/rfc5280#section-6.1.4","https://github.com/lkloliver/poc/tree/main/CVE-2026-88648"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88648","description":"In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"c402b4f4f9225693","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.9:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.9","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-95210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95210","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95210","date":"2026-11-09","epss":0.002,"percentile":0.0996}],"risk":0.1,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95210"},"relatedVulnerabilities":[{"id":"CVE-2026-95210","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95210","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-95210","date":"2026-11-09","epss":0.002,"percentile":0.0996}],"urls":["http://gnutls.com","https://gist.github.com/lkloliver/4aad23689202720c4068f43b3c6069c7","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://github.com/lkloliver/poc/tree/main/CVE-2026-95210"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95210","description":"GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24193","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24193","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24193","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24193","date":"2026-11-09","epss":0.00197,"percentile":0.09515}],"risk":0.0985,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24193"},"relatedVulnerabilities":[{"id":"CVE-2026-24193","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24193","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24193","date":"2026-11-09","epss":0.00197,"percentile":0.09515}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24193","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24193"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24193","description":"NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119375","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119375","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-09","epss":0.00195,"percentile":0.09207}],"risk":0.09749999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119375"},"relatedVulnerabilities":[{"id":"CVE-2026-119375","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-09","epss":0.00195,"percentile":0.09207}],"urls":["https://abraxaslabs.tech/research/sqlite-wal-pagesize","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672","https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e","https://sqlite.org/bugs/info/2026-08-17T15:54:41Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f9b4ee369557c36c","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119375","description":"SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119371","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-09","epss":0.00191,"percentile":0.08818}],"risk":0.0955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119371"},"relatedVulnerabilities":[{"id":"CVE-2026-119371","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-09","epss":0.00191,"percentile":0.08818}],"urls":["https://abraxaslabs.tech/research/sqlite-cte-nest","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754","https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb","https://sqlite.org/bugs/info/2026-10-04T04:58:58Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f54730871303e655","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119371","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24187","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24187","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24187","date":"2026-11-09","epss":0.00188,"percentile":0.08454}],"risk":0.094,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24187"},"relatedVulnerabilities":[{"id":"CVE-2026-24187","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":6.1,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24187","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24187","date":"2026-11-09","epss":0.00188,"percentile":0.08454}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24187","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24187"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24187","description":"NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119376","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-09","epss":0.00183,"percentile":0.07902}],"risk":0.0915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119376"},"relatedVulnerabilities":[{"id":"CVE-2026-119376","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-09","epss":0.00183,"percentile":0.07902}],"urls":["https://abraxaslabs.tech/research/sqlite-collate-depth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175","https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2","https://sqlite.org/bugs/info/2026-10-04T04:50:56Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/252c0b7bf5a727d2","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119376","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47586","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47586","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47586","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47586","date":"2026-11-09","epss":0.0018,"percentile":0.07598}],"risk":0.09,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47586"},"relatedVulnerabilities":[{"id":"CVE-2026-47586","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47586","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47586","date":"2026-11-09","epss":0.0018,"percentile":0.07598}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47586"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47586","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel module where an attacker could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-23282","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-23282","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-23282","cwe":"CWE-415","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23282","date":"2026-11-09","epss":0.00179,"percentile":0.07525}],"risk":0.0895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-23282"},"relatedVulnerabilities":[{"id":"CVE-2025-23282","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-23282","cwe":"CWE-415","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23282","date":"2026-11-09","epss":0.00179,"percentile":0.07525}],"urls":["https://nvidia.custhelp.com/app/answers/detail/a_id/5703","https://www.cve.org/CVERecord?id=CVE-2025-23282"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-23282","description":"NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to use a race condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}]},{"artifact":{"id":"065d773192a6b192","cpes":["cpe:2.3:a:librtmp1:librtmp1:2.4\\+20151223.gitfa8646d.1-2build4:*:*:*:*:*:*:*"],"name":"librtmp1","purl":"pkg:deb/ubuntu/librtmp1@2.4%2B20151223.gitfa8646d.1-2build4?arch=amd64&distro=ubuntu-22.04&upstream=rtmpdump","type":"deb","version":"2.4+20151223.gitfa8646d.1-2build4","language":"","licenses":["sha256:4302abcc1ea1b6cbe8d19c79b892acf78878030220210707c19006828866207c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/librtmp1/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/librtmp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/librtmp1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/librtmp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"rtmpdump"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112060","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"rtmpdump","version":"2.4+20151223.gitfa8646d.1-2build4"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-112060","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112060","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-112060","date":"2026-11-09","epss":0.00177,"percentile":0.07301}],"risk":0.08850000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112060"},"relatedVulnerabilities":[{"id":"CVE-2026-112060","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.4,"impactScore":4.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112060","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-112060","date":"2026-11-09","epss":0.00177,"percentile":0.07301}],"urls":["https://git.ffmpeg.org/gitweb/rtmpdump.git/blob/138fdb258d9fc26f1843fd1b891180416c9dc575:/librtmp/amf.c","https://hackmd.io/@haindpwn/librtmp-amf3-decode-and-strict-array-oob","https://rtmpdump.mplayerhq.hu/","https://www.vulncheck.com/advisories/librtmp-rtmpdump-through-2.6-heap-out-of-bounds-write-via-amf3-decode"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112060","description":"librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes."}]},{"artifact":{"id":"2d995e9dbc2ddbc0","cpes":["cpe:2.3:a:dirmngr:dirmngr:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"dirmngr","purl":"pkg:deb/ubuntu/dirmngr@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dirmngr/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/dirmngr/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.list"},{"path":"/var/lib/dpkg/info/dirmngr.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.postinst"},{"path":"/var/lib/dpkg/info/dirmngr.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.postrm"},{"path":"/var/lib/dpkg/info/dirmngr.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.preinst"},{"path":"/var/lib/dpkg/info/dirmngr.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.prerm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"87d85fc31d97759c","cpes":["cpe:2.3:a:gnupg:gnupg:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/ubuntu/gnupg@2.2.27-3ubuntu2.5?arch=all&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"21e433471ebcdd4c","cpes":["cpe:2.3:a:gnupg-l10n:gnupg-l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-l10n:gnupg_l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg-l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg_l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg-l10n","purl":"pkg:deb/ubuntu/gnupg-l10n@2.2.27-3ubuntu2.5?arch=all&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-l10n/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-l10n.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"4da066024d6bd485","cpes":["cpe:2.3:a:gnupg-utils:gnupg-utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-utils:gnupg_utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg-utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg_utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg-utils","purl":"pkg:deb/ubuntu/gnupg-utils@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-utils/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-utils.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"be7029cb13ed57af","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:deb/ubuntu/gnupg2@2.2.27-3ubuntu2.5?arch=all&distro=ubuntu-22.04","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg2/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg2.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg2.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg2.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"ac02a22afc1598d4","cpes":["cpe:2.3:a:gpg:gpg:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg","purl":"pkg:deb/ubuntu/gpg@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"77792b77bb0fcaba","cpes":["cpe:2.3:a:gpg-agent:gpg-agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-agent:gpg_agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg-agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg_agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg-agent","purl":"pkg:deb/ubuntu/gpg-agent@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-agent/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg-agent/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.list"},{"path":"/var/lib/dpkg/info/gpg-agent.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.postinst"},{"path":"/var/lib/dpkg/info/gpg-agent.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.postrm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"fe3c51f7337154a3","cpes":["cpe:2.3:a:gpg-wks-client:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks-client:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_client:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_client:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg-wks-client","purl":"pkg:deb/ubuntu/gpg-wks-client@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-wks-client/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg-wks-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-client.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-client.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-client.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"bf862e676a9f55f3","cpes":["cpe:2.3:a:gpg-wks-server:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks-server:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_server:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_server:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg-wks-server","purl":"pkg:deb/ubuntu/gpg-wks-server@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-wks-server/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg-wks-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-server.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-server.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-server.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"5c6a194c9301a444","cpes":["cpe:2.3:a:gpgconf:gpgconf:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpgconf","purl":"pkg:deb/ubuntu/gpgconf@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgconf/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpgconf/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgconf.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgconf.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"5e7058fe04099641","cpes":["cpe:2.3:a:gpgsm:gpgsm:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpgsm","purl":"pkg:deb/ubuntu/gpgsm@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgsm/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpgsm/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgsm.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgsm.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"2551cbcb93b2aea5","cpes":["cpe:2.3:a:gpgv:gpgv:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-11-09","epss":0.00293,"percentile":0.22047}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-33221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-33221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-33221","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-33221","date":"2026-11-09","epss":0.00175,"percentile":0.07016}],"risk":0.08750000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-33221"},"relatedVulnerabilities":[{"id":"CVE-2025-33221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-33221","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-33221","date":"2026-11-09","epss":0.00175,"percentile":0.07016}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-33221","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2025-33221"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-33221","description":"NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where a user could cause an incorrect permission assignment for a critical resource. A successful exploit of this vulnerability might lead to data tampering and denial of service."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119591","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119591","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-09","epss":0.00171,"percentile":0.06526}],"risk":0.08549999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119591"},"relatedVulnerabilities":[{"id":"CVE-2026-119591","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-09","epss":0.00171,"percentile":0.06526}],"urls":["https://abraxaslabs.tech/research/sqlite-values-union","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199","https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2","https://sqlite.org/bugs/info/2026-10-04T05:34:47Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/ab621a3e11ee4acc","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119591","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."}]},{"artifact":{"id":"c402b4f4f9225693","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.7.3-4ubuntu1.9:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.7.3-4ubuntu1.9?arch=amd64&distro=ubuntu-22.04&upstream=gnutls28","type":"deb","version":"3.7.3-4ubuntu1.9","language":"","licenses":["sha256:c2a08ee31ea9f0a4fc0f4d590c5481f5b7fc2d325b04ae74c719fa7894dcbdd7"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-67693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnutls28","version":"3.7.3-4ubuntu1.9"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-67693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-67693","date":"2026-11-09","epss":0.00167,"percentile":0.05965}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-67693"},"relatedVulnerabilities":[{"id":"CVE-2026-67693","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-67693","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-67693","date":"2026-11-09","epss":0.00167,"percentile":0.05965}],"urls":["https://gist.github.com/lkloliver/6fbfc191bc6163942c8017551ac3f238","https://gitlab.com/gnutls/gnutls/-/blob/3.8.13/lib/x509/verify.c#L1119-1178","https://gitlab.com/gnutls/gnutls/-/blob/e2169a87c7fb91935c2845088204b102baed4c5f/SECURITY.md","https://gitlab.com/gnutls/gnutls/-/work_items/1642","https://gitlab.com/gnutls/gnutls/-/work_items/1965","https://github.com/lkloliver/poc/tree/main/CVE-2026-67693"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-67693","description":"GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24196","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24196","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24196","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24196","date":"2026-11-09","epss":0.00166,"percentile":0.05937}],"risk":0.083,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24196"},"relatedVulnerabilities":[{"id":"CVE-2026-24196","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24196","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24196","date":"2026-11-09","epss":0.00166,"percentile":0.05937}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24196","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24196"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24196","description":"NVIDIA Display Driver for Linux contains a vulnerability where a user could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to denial of service and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24195","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24195","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24195","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24195","date":"2026-11-09","epss":0.00162,"percentile":0.05469}],"risk":0.08099999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24195"},"relatedVulnerabilities":[{"id":"CVE-2026-24195","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24195","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24195","date":"2026-11-09","epss":0.00162,"percentile":0.05469}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24195","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24195"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24195","description":"NVIDIA Display Driver for Linux contains a vulnerability in UVM, where a user could cause improper input validation. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119373","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119373","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-09","epss":0.00162,"percentile":0.05446}],"risk":0.08099999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119373"},"relatedVulnerabilities":[{"id":"CVE-2026-119373","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-09","epss":0.00162,"percentile":0.05446}],"urls":["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/a7f8c92f62","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-23345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-23345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-23345","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23345","date":"2026-11-09","epss":0.0016,"percentile":0.05217}],"risk":0.08,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-23345"},"relatedVulnerabilities":[{"id":"CVE-2025-23345","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-23345","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23345","date":"2026-11-09","epss":0.0016,"percentile":0.05217}],"urls":["https://nvidia.custhelp.com/app/answers/detail/a_id/5703","https://www.cve.org/CVERecord?id=CVE-2025-23345"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-23345","description":"NVIDIA Display Driver for Windows and Linux contains a vulnerability in a video decoder, where an attacker might cause an out-of-bounds read. A successful exploit of this vulnerability might lead to information disclosure or denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24197","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24197","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24197","cwe":"CWE-1188","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24197","date":"2026-11-09","epss":0.0016,"percentile":0.05133}],"risk":0.08,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24197"},"relatedVulnerabilities":[{"id":"CVE-2026-24197","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24197","cwe":"CWE-1188","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24197","date":"2026-11-09","epss":0.0016,"percentile":0.05133}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24197","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24197"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24197","description":"NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an insecure default initialization of memory subsystem routing resources could lead to data corruption or a hang during partition reconfiguration. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24198","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24198","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24198","cwe":"CWE-200","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24198","date":"2026-11-09","epss":0.00155,"percentile":0.04705}],"risk":0.0775,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24198"},"relatedVulnerabilities":[{"id":"CVE-2026-24198","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.6,"impactScore":4.8,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24198","cwe":"CWE-200","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24198","date":"2026-11-09","epss":0.00155,"percentile":0.04705}],"urls":["https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24198"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24198","description":"NVIDIA GPU Display Driver for Linux  contains a vulnerability where an advanced attacker could use a race condition to leak sensitive memory, which might cause limited exposure of sensitive information to an unauthorized actor. A successful exploit of this vulnerability might lead to denial of service, data tampering, and information disclosure."}]},{"artifact":{"id":"bfd86512a80abb42","cpes":["cpe:2.3:a:libacl1:libacl1:2.3.1-1:*:*:*:*:*:*:*"],"name":"libacl1","purl":"pkg:deb/ubuntu/libacl1@2.3.1-1?arch=amd64&distro=ubuntu-22.04&upstream=acl","type":"deb","version":"2.3.1-1","language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"acl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54369","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"acl","version":"2.3.1-1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-54369","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54369","date":"2026-11-09","epss":0.00153,"percentile":0.04476}],"risk":0.0765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54369"},"relatedVulnerabilities":[{"id":"CVE-2026-54369","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54369","date":"2026-11-09","epss":0.00153,"percentile":0.04476}],"urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions","https://access.redhat.com/errata/RHSA-2026:34351","https://access.redhat.com/errata/RHSA-2026:42736","https://access.redhat.com/errata/RHSA-2026:42739","https://access.redhat.com/errata/RHSA-2026:43420","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:54769","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:64805","https://access.redhat.com/errata/RHSA-2026:67140","https://access.redhat.com/errata/RHSA-2026:67142","https://access.redhat.com/errata/RHSA-2026:67144","https://access.redhat.com/security/cve/CVE-2026-54369","https://bugzilla.redhat.com/show_bug.cgi?id=2490277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54369","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24194","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24194","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24194","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24194","date":"2026-11-09","epss":0.00152,"percentile":0.04361}],"risk":0.076,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24194"},"relatedVulnerabilities":[{"id":"CVE-2026-24194","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24194","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24194","date":"2026-11-09","epss":0.00152,"percentile":0.04361}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24194","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24194","description":"NVIDIA Display Driver for Linux contains a vulnerability in a kernel mode layer handler, where a user could cause improper permission handling. A successful exploit of this vulnerability might lead to denial of service, escalation of privileges, information disclosure, data tampering, and code execution."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119372","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119372","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-09","epss":0.00147,"percentile":0.03962}],"risk":0.0735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119372"},"relatedVulnerabilities":[{"id":"CVE-2026-119372","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-09","epss":0.00147,"percentile":0.03962}],"urls":["https://abraxaslabs.tech/research/sqlite-fts3-snippet","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561","https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731","https://sqlite.org/bugs/info/2026-08-17T09:18:24Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/e4635c4153","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119372","description":"SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-23300","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-23300","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-23300","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23300","date":"2026-11-09","epss":0.00147,"percentile":0.03961}],"risk":0.0735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-23300"},"relatedVulnerabilities":[{"id":"CVE-2025-23300","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-23300","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23300","date":"2026-11-09","epss":0.00147,"percentile":0.03961}],"urls":["https://nvidia.custhelp.com/app/answers/detail/a_id/5703","https://www.cve.org/CVERecord?id=CVE-2025-23300"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-23300","description":"NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer dereference by allocating a specific memory resource. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47491","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47491","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47491","cwe":"CWE-404","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47491","date":"2026-11-09","epss":0.00146,"percentile":0.03872}],"risk":0.073,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47491"},"relatedVulnerabilities":[{"id":"CVE-2026-47491","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47491","cwe":"CWE-404","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47491","date":"2026-11-09","epss":0.00146,"percentile":0.03872}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47491"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47491","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory resources, leaving a mapping accessible after the underlying memory is reused. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47501","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47501","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47501","date":"2026-11-09","epss":0.00146,"percentile":0.03872}],"risk":0.073,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47501"},"relatedVulnerabilities":[{"id":"CVE-2026-47501","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47501","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47501","date":"2026-11-09","epss":0.00146,"percentile":0.03872}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47501"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47501","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write by supplying mismatched memory buffers during event buffer setup. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47504","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47504","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47504","cwe":"CWE-843","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47504","date":"2026-11-09","epss":0.00146,"percentile":0.03872}],"risk":0.073,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47504"},"relatedVulnerabilities":[{"id":"CVE-2026-47504","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47504","cwe":"CWE-843","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47504","date":"2026-11-09","epss":0.00146,"percentile":0.03872}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47504"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47504","description":"NVIDIA Linux GPU Display Driver contains a vulnerability in the NGX updater where an outdated embedded cryptographic library is susceptible to type confusion. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47507","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47507","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47507","cwe":"CWE-129","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47507","date":"2026-11-09","epss":0.00146,"percentile":0.03871}],"risk":0.073,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47507"},"relatedVulnerabilities":[{"id":"CVE-2026-47507","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47507","cwe":"CWE-129","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47507","date":"2026-11-09","epss":0.00146,"percentile":0.03871}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47507"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47507","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds array access. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47508","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47508","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47508","cwe":"CWE-681","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47508","date":"2026-11-09","epss":0.00146,"percentile":0.03871}],"risk":0.073,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47508"},"relatedVulnerabilities":[{"id":"CVE-2026-47508","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47508","cwe":"CWE-681","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47508","date":"2026-11-09","epss":0.00146,"percentile":0.03871}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47508"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47508","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an incorrect conversion between numeric types. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47510","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47510","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47510","cwe":"CWE-190","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47510","date":"2026-11-09","epss":0.00146,"percentile":0.03871}],"risk":0.073,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47510"},"relatedVulnerabilities":[{"id":"CVE-2026-47510","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47510","cwe":"CWE-190","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47510","date":"2026-11-09","epss":0.00146,"percentile":0.03871}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47510"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47510","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an integer overflow leading to an out-of-bounds write to GPU memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47512","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47512","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47512","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47512","date":"2026-11-09","epss":0.00146,"percentile":0.03871}],"risk":0.073,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47512"},"relatedVulnerabilities":[{"id":"CVE-2026-47512","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47512","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47512","date":"2026-11-09","epss":0.00146,"percentile":0.03871}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47512"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47512","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read leading to kernel information disclosure. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47494","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47494","cwe":"CWE-134","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47494","date":"2026-11-09","epss":0.00146,"percentile":0.0387}],"risk":0.073,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47494"},"relatedVulnerabilities":[{"id":"CVE-2026-47494","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47494","cwe":"CWE-134","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47494","date":"2026-11-09","epss":0.00146,"percentile":0.0387}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47494"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47494","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47511","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47511","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47511","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47511","date":"2026-11-09","epss":0.00146,"percentile":0.0387}],"risk":0.073,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47511"},"relatedVulnerabilities":[{"id":"CVE-2026-47511","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47511","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47511","date":"2026-11-09","epss":0.00146,"percentile":0.0387}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47511"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47511","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47596","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47596","date":"2026-11-09","epss":0.00144,"percentile":0.03697}],"risk":0.07200000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47596"},"relatedVulnerabilities":[{"id":"CVE-2026-47596","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":6.1,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47596","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47596","date":"2026-11-09","epss":0.00144,"percentile":0.03697}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47596"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47596","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability might lead to code execution and escalation of privileges."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47500","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47500","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47500","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47500","date":"2026-11-09","epss":0.00142,"percentile":0.03567}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47500"},"relatedVulnerabilities":[{"id":"CVE-2026-47500","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47500","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47500","date":"2026-11-09","epss":0.00142,"percentile":0.03567}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47500"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47500","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where improper cleanup of reference counts during error paths could lead to a use-after-free condition. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47529","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47529","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47529","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47529","date":"2026-11-09","epss":0.00142,"percentile":0.03556}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47529"},"relatedVulnerabilities":[{"id":"CVE-2026-47529","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47529","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47529","date":"2026-11-09","epss":0.00142,"percentile":0.03556}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47529"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47529","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47532","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47532","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47532","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47532","date":"2026-11-09","epss":0.00142,"percentile":0.03556}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47532"},"relatedVulnerabilities":[{"id":"CVE-2026-47532","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47532","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47532","date":"2026-11-09","epss":0.00142,"percentile":0.03556}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47532"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47532","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47542","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47542","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47542","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47542","date":"2026-11-09","epss":0.00142,"percentile":0.03556}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47542"},"relatedVulnerabilities":[{"id":"CVE-2026-47542","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47542","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47542","date":"2026-11-09","epss":0.00142,"percentile":0.03556}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47542"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47542","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47546","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47546","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47546","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47546","date":"2026-11-09","epss":0.00142,"percentile":0.03556}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47546"},"relatedVulnerabilities":[{"id":"CVE-2026-47546","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47546","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47546","date":"2026-11-09","epss":0.00142,"percentile":0.03556}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47546"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47546","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47524","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47524","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47524","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47524","date":"2026-11-09","epss":0.00142,"percentile":0.03555}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47524"},"relatedVulnerabilities":[{"id":"CVE-2026-47524","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47524","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47524","date":"2026-11-09","epss":0.00142,"percentile":0.03555}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47524"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47524","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47525","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47525","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47525","cwe":"CWE-129","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47525","date":"2026-11-09","epss":0.00142,"percentile":0.03555}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47525"},"relatedVulnerabilities":[{"id":"CVE-2026-47525","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47525","cwe":"CWE-129","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47525","date":"2026-11-09","epss":0.00142,"percentile":0.03555}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47525"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47525","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper validation of an array index. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47533","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47533","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47533","cwe":"CWE-129","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47533","date":"2026-11-09","epss":0.00142,"percentile":0.03555}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47533"},"relatedVulnerabilities":[{"id":"CVE-2026-47533","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47533","cwe":"CWE-129","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47533","date":"2026-11-09","epss":0.00142,"percentile":0.03555}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47533"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47533","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper validation of an array index. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47538","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47538","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47538","date":"2026-11-09","epss":0.00142,"percentile":0.03555}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47538"},"relatedVulnerabilities":[{"id":"CVE-2026-47538","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47538","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47538","date":"2026-11-09","epss":0.00142,"percentile":0.03555}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47538"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47538","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47522","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47522","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47522","date":"2026-11-09","epss":0.00142,"percentile":0.03554}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47522"},"relatedVulnerabilities":[{"id":"CVE-2026-47522","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47522","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47522","date":"2026-11-09","epss":0.00142,"percentile":0.03554}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47522"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47522","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47527","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47527","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47527","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47527","date":"2026-11-09","epss":0.00142,"percentile":0.03554}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47527"},"relatedVulnerabilities":[{"id":"CVE-2026-47527","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47527","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47527","date":"2026-11-09","epss":0.00142,"percentile":0.03554}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47527"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47527","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47537","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47537","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47537","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47537","date":"2026-11-09","epss":0.00142,"percentile":0.03554}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47537"},"relatedVulnerabilities":[{"id":"CVE-2026-47537","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47537","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47537","date":"2026-11-09","epss":0.00142,"percentile":0.03554}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47537"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47537","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47547","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47547","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47547","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47547","date":"2026-11-09","epss":0.00142,"percentile":0.03554}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47547"},"relatedVulnerabilities":[{"id":"CVE-2026-47547","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47547","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47547","date":"2026-11-09","epss":0.00142,"percentile":0.03554}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47547"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47547","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47509","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47509","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47509","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47509","date":"2026-11-09","epss":0.00142,"percentile":0.03553}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47509"},"relatedVulnerabilities":[{"id":"CVE-2026-47509","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47509","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47509","date":"2026-11-09","epss":0.00142,"percentile":0.03553}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47509"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47509","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47515","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47515","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47515","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47515","date":"2026-11-09","epss":0.00142,"percentile":0.03553}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47515"},"relatedVulnerabilities":[{"id":"CVE-2026-47515","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47515","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47515","date":"2026-11-09","epss":0.00142,"percentile":0.03553}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47515"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47515","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read via an unbounded string operation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47543","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47543","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47543","date":"2026-11-09","epss":0.00142,"percentile":0.03553}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47543"},"relatedVulnerabilities":[{"id":"CVE-2026-47543","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47543","cwe":"CWE-20","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47543","date":"2026-11-09","epss":0.00142,"percentile":0.03553}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47543"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47543","description":"VIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-23332","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-23332","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-23332","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23332","date":"2026-11-09","epss":0.00142,"percentile":0.03552}],"risk":0.07100000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-23332"},"relatedVulnerabilities":[{"id":"CVE-2025-23332","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-23332","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2025-23332","date":"2026-11-09","epss":0.00142,"percentile":0.03552}],"urls":["https://nvidia.custhelp.com/app/answers/detail/a_id/5703","https://www.cve.org/CVERecord?id=CVE-2025-23332"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-23332","description":"NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where an attacker might be able to trigger a null pointer deference. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"3f7b6ec6ebe12456","cpes":["cpe:2.3:a:tar:tar:1.34\\+dfsg-1ubuntu0.1.22.04.6:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.34%2Bdfsg-1ubuntu0.1.22.04.6?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"1.34+dfsg-1ubuntu0.1.22.04.6","language":"","licenses":["sha256:5e07fa97dc98e502dc15d09d4c14647ec77509f949267a30d1341cadf84d629f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18508","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"tar","version":"1.34+dfsg-1ubuntu0.1.22.04.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-18508","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-11-09","epss":0.00141,"percentile":0.03451}],"risk":0.07050000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18508"},"relatedVulnerabilities":[{"id":"CVE-2026-18508","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-11-09","epss":0.00141,"percentile":0.03451}],"urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47558","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47558","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47558","cwe":"CWE-415","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47558","date":"2026-11-09","epss":0.00136,"percentile":0.03089}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47558"},"relatedVulnerabilities":[{"id":"CVE-2026-47558","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47558","cwe":"CWE-415","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47558","date":"2026-11-09","epss":0.00136,"percentile":0.03089}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47558"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47558","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free of imported memory state. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47561","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47561","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47561","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47561","date":"2026-11-09","epss":0.00136,"percentile":0.03089}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47561"},"relatedVulnerabilities":[{"id":"CVE-2026-47561","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47561","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47561","date":"2026-11-09","epss":0.00136,"percentile":0.03089}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47561"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47561","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validated, allowing an unprivileged caller to trigger an out-of-bounds write in kernel memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47513","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47513","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47513","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47513","date":"2026-11-09","epss":0.00136,"percentile":0.03088}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47513"},"relatedVulnerabilities":[{"id":"CVE-2026-47513","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47513","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47513","date":"2026-11-09","epss":0.00136,"percentile":0.03088}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47513"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47513","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read from kernel heap memory. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47514","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47514","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47514","cwe":"CWE-200","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47514","date":"2026-11-09","epss":0.00136,"percentile":0.03088}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47514"},"relatedVulnerabilities":[{"id":"CVE-2026-47514","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47514","cwe":"CWE-200","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47514","date":"2026-11-09","epss":0.00136,"percentile":0.03088}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47514"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47514","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause exposure of kernel stack contents including return addresses and pointers. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47530","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47530","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47530","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47530","date":"2026-11-09","epss":0.00136,"percentile":0.03088}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47530"},"relatedVulnerabilities":[{"id":"CVE-2026-47530","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47530","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47530","date":"2026-11-09","epss":0.00136,"percentile":0.03088}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47530"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47530","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47556","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47556","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47556","cwe":"CWE-190","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47556","date":"2026-11-09","epss":0.00136,"percentile":0.03088}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47556"},"relatedVulnerabilities":[{"id":"CVE-2026-47556","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47556","cwe":"CWE-190","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47556","date":"2026-11-09","epss":0.00136,"percentile":0.03088}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47556"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47556","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an integer overflow that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47523","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47523","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47523","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47523","date":"2026-11-09","epss":0.00136,"percentile":0.03087}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47523"},"relatedVulnerabilities":[{"id":"CVE-2026-47523","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47523","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47523","date":"2026-11-09","epss":0.00136,"percentile":0.03087}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47523"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47523","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47528","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47528","cwe":"CWE-824","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47528","date":"2026-11-09","epss":0.00136,"percentile":0.03087}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47528"},"relatedVulnerabilities":[{"id":"CVE-2026-47528","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47528","cwe":"CWE-824","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47528","date":"2026-11-09","epss":0.00136,"percentile":0.03087}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47528"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47528","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an access of an uninitialized pointer. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47545","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47545","date":"2026-11-09","epss":0.00136,"percentile":0.03087}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47545"},"relatedVulnerabilities":[{"id":"CVE-2026-47545","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47545","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47545","date":"2026-11-09","epss":0.00136,"percentile":0.03087}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47545"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47545","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47573","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47573","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47573","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47573","date":"2026-11-09","epss":0.00136,"percentile":0.03087}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47573"},"relatedVulnerabilities":[{"id":"CVE-2026-47573","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47573","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47573","date":"2026-11-09","epss":0.00136,"percentile":0.03087}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47573"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47573","description":"NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47540","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47540","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47540","cwe":"CWE-191","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47540","date":"2026-11-09","epss":0.00136,"percentile":0.03086}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47540"},"relatedVulnerabilities":[{"id":"CVE-2026-47540","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47540","cwe":"CWE-191","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47540","date":"2026-11-09","epss":0.00136,"percentile":0.03086}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47540"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47540","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47548","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47548","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47548","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47548","date":"2026-11-09","epss":0.00136,"percentile":0.03086}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47548"},"relatedVulnerabilities":[{"id":"CVE-2026-47548","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47548","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47548","date":"2026-11-09","epss":0.00136,"percentile":0.03086}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47548"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47548","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47553","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47553","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47553","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47553","date":"2026-11-09","epss":0.00136,"percentile":0.03086}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47553"},"relatedVulnerabilities":[{"id":"CVE-2026-47553","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47553","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47553","date":"2026-11-09","epss":0.00136,"percentile":0.03086}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47553"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47553","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47569","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47569","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47569","cwe":"CWE-843","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47569","date":"2026-11-09","epss":0.00136,"percentile":0.03086}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47569"},"relatedVulnerabilities":[{"id":"CVE-2026-47569","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47569","cwe":"CWE-843","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47569","date":"2026-11-09","epss":0.00136,"percentile":0.03086}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47569"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47569","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a type confusion via a handle recycle race. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47563","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47563","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47563","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47563","date":"2026-11-09","epss":0.00136,"percentile":0.03085}],"risk":0.068,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47563"},"relatedVulnerabilities":[{"id":"CVE-2026-47563","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47563","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47563","date":"2026-11-09","epss":0.00136,"percentile":0.03085}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47563"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47563","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47551","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47551","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47551","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47551","date":"2026-11-09","epss":0.00133,"percentile":0.02825}],"risk":0.0665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47551"},"relatedVulnerabilities":[{"id":"CVE-2026-47551","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47551","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47551","date":"2026-11-09","epss":0.00133,"percentile":0.02825}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47551"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47551","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47516","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47516","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47516","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47516","date":"2026-11-09","epss":0.00133,"percentile":0.02824}],"risk":0.0665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47516"},"relatedVulnerabilities":[{"id":"CVE-2026-47516","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47516","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47516","date":"2026-11-09","epss":0.00133,"percentile":0.02824}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47516"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47516","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47560","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47560","date":"2026-11-09","epss":0.00133,"percentile":0.02824}],"risk":0.0665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47560"},"relatedVulnerabilities":[{"id":"CVE-2026-47560","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47560","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47560","date":"2026-11-09","epss":0.00133,"percentile":0.02824}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47560"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47560","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47489","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47489","date":"2026-11-09","epss":0.00131,"percentile":0.02693}],"risk":0.0655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47489"},"relatedVulnerabilities":[{"id":"CVE-2026-47489","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47489","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47489","date":"2026-11-09","epss":0.00131,"percentile":0.02693}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47489"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47489","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47552","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47552","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47552","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47552","date":"2026-11-09","epss":0.00129,"percentile":0.02572}],"risk":0.0645,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47552"},"relatedVulnerabilities":[{"id":"CVE-2026-47552","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47552","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47552","date":"2026-11-09","epss":0.00129,"percentile":0.02572}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47552"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47552","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorization check and modify privileged configuration. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"50c5b83c4a9783aa","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.37.2-2ubuntu0.8:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.37.2-2ubuntu0.8?arch=amd64&distro=ubuntu-22.04&upstream=sqlite3","type":"deb","version":"3.37.2-2ubuntu0.8","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119377","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"sqlite3","version":"3.37.2-2ubuntu0.8"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-119377","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-09","epss":0.00129,"percentile":0.02517}],"risk":0.0645,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119377"},"relatedVulnerabilities":[{"id":"CVE-2026-119377","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-09","epss":0.00129,"percentile":0.02517}],"urls":["https://abraxaslabs.tech/research/sqlite-fj-using-auth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/2cb22877683680c1","https://sqlite.org/src/info/bbd69ce274620008","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."}]},{"artifact":{"id":"e055751ea35a0539","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.10?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.10","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15649","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2025-15649","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15649","cwe":"CWE-248","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-15649","date":"2026-11-09","epss":0.00127,"percentile":0.02398}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15649"},"relatedVulnerabilities":[{"id":"CVE-2025-15649","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15649","cwe":"CWE-248","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-15649","date":"2026-11-09","epss":0.00127,"percentile":0.02398}],"urls":["https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch","https://github.com/pmqs/IO-Compress/issues/65","https://metacpan.org/release/PMQS/IO-Compress-2.215/changes","http://www.openwall.com/lists/oss-security/2026/05/27/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15649","description":"IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.\n\n_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.\n\nThe exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47592","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47592","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47592","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47592","date":"2026-11-09","epss":0.00127,"percentile":0.02393}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47592"},"relatedVulnerabilities":[{"id":"CVE-2026-47592","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47592","cwe":"CWE-125","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47592","date":"2026-11-09","epss":0.00127,"percentile":0.02393}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47592","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47503","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47503","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47503","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47503","date":"2026-11-09","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47503"},"relatedVulnerabilities":[{"id":"CVE-2026-47503","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47503","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47503","date":"2026-11-09","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47503"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47503","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest VM user may cause an out-of-bounds write by sending a crafted RPC message with invalid performance state list size parameters. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47600","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47600","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47600","cwe":"CWE-908","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47600","date":"2026-11-09","epss":0.00127,"percentile":0.02392}],"risk":0.0635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47600"},"relatedVulnerabilities":[{"id":"CVE-2026-47600","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47600","cwe":"CWE-908","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47600","date":"2026-11-09","epss":0.00127,"percentile":0.02392}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47600"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47600","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an error-handling path could operate on an improperly initialized resource. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24182","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24182","cwe":"CWE-667","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24182","date":"2026-11-09","epss":0.00125,"percentile":0.02244}],"risk":0.0625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24182"},"relatedVulnerabilities":[{"id":"CVE-2026-24182","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24182","cwe":"CWE-667","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24182","date":"2026-11-09","epss":0.00125,"percentile":0.02244}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24182","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24182"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24182","description":"NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47589","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47589","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47589","date":"2026-11-09","epss":0.00123,"percentile":0.02111}],"risk":0.0615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47589"},"relatedVulnerabilities":[{"id":"CVE-2026-47589","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47589","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47589","date":"2026-11-09","epss":0.00123,"percentile":0.02111}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47589"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47589","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47590","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47590","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47590","date":"2026-11-09","epss":0.00123,"percentile":0.02111}],"risk":0.0615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47590"},"relatedVulnerabilities":[{"id":"CVE-2026-47590","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47590","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47590","date":"2026-11-09","epss":0.00123,"percentile":0.02111}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47590"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47590","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47587","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47587","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47587","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47587","date":"2026-11-09","epss":0.00123,"percentile":0.0211}],"risk":0.0615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47587"},"relatedVulnerabilities":[{"id":"CVE-2026-47587","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47587","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47587","date":"2026-11-09","epss":0.00123,"percentile":0.0211}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47587"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47587","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47588","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47588","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47588","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47588","date":"2026-11-09","epss":0.00123,"percentile":0.0211}],"risk":0.0615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47588"},"relatedVulnerabilities":[{"id":"CVE-2026-47588","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47588","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47588","date":"2026-11-09","epss":0.00123,"percentile":0.0211}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47588","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47594","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47594","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47594","date":"2026-11-09","epss":0.00123,"percentile":0.0211}],"risk":0.0615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47594"},"relatedVulnerabilities":[{"id":"CVE-2026-47594","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47594","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47594","date":"2026-11-09","epss":0.00123,"percentile":0.0211}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47594"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47594","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47555","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47555","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47555","cwe":"CWE-908","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47555","date":"2026-11-09","epss":0.00123,"percentile":0.02101}],"risk":0.0615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47555"},"relatedVulnerabilities":[{"id":"CVE-2026-47555","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47555","cwe":"CWE-908","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47555","date":"2026-11-09","epss":0.00123,"percentile":0.02101}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47555"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47555","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause uninitialized kernel memory to be copied back to userspace. A successful exploit of this vulnerability might lead to information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47518","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47518","cwe":"CWE-732","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47518","date":"2026-11-09","epss":0.00122,"percentile":0.02002}],"risk":0.061,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47518"},"relatedVulnerabilities":[{"id":"CVE-2026-47518","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6,"impactScore":5.5,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47518","cwe":"CWE-732","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47518","date":"2026-11-09","epss":0.00122,"percentile":0.02002}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47518"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47518","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit of this vulnerability might lead to code execution and escalation of privileges."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47559","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47559","date":"2026-11-09","epss":0.00122,"percentile":0.01957}],"risk":0.061,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47559"},"relatedVulnerabilities":[{"id":"CVE-2026-47559","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47559","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47559","date":"2026-11-09","epss":0.00122,"percentile":0.01957}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47559"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47559","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonging to another user's process. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47506","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47506","cwe":"CWE-121","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47506","date":"2026-11-09","epss":0.00121,"percentile":0.01906}],"risk":0.0605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47506"},"relatedVulnerabilities":[{"id":"CVE-2026-47506","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47506","cwe":"CWE-121","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47506","date":"2026-11-09","epss":0.00121,"percentile":0.01906}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47506"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47506","description":"NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode color transform path where excessive kernel stack use occurs when evaluating YCbCr420 display emulation. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47534","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47534","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47534","cwe":"CWE-369","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47534","date":"2026-11-09","epss":0.00121,"percentile":0.01905}],"risk":0.0605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47534"},"relatedVulnerabilities":[{"id":"CVE-2026-47534","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47534","cwe":"CWE-369","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47534","date":"2026-11-09","epss":0.00121,"percentile":0.01905}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47534"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47534","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a divide by zero. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47557","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47557","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47557","date":"2026-11-09","epss":0.00121,"percentile":0.01901}],"risk":0.0605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47557"},"relatedVulnerabilities":[{"id":"CVE-2026-47557","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47557","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47557","date":"2026-11-09","epss":0.00121,"percentile":0.01901}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47557"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47557","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47566","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47566","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47566","cwe":"CWE-401","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47566","date":"2026-11-09","epss":0.00121,"percentile":0.019}],"risk":0.0605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47566"},"relatedVulnerabilities":[{"id":"CVE-2026-47566","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47566","cwe":"CWE-401","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47566","date":"2026-11-09","epss":0.00121,"percentile":0.019}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47566"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47566","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a memory leak in error paths leading to kernel memory exhaustion. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47601","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47601","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47601","date":"2026-11-09","epss":0.00121,"percentile":0.01892}],"risk":0.0605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47601"},"relatedVulnerabilities":[{"id":"CVE-2026-47601","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47601","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47601","date":"2026-11-09","epss":0.00121,"percentile":0.01892}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47601"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47601","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module DMA-BUF import path where an unprivileged local user could cause improper preservation of memory access permissions when importing a read-only buffer from another device's DMA-BUF exporter. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47526","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47526","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47526","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47526","date":"2026-11-09","epss":0.0012,"percentile":0.01877}],"risk":0.06,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47526"},"relatedVulnerabilities":[{"id":"CVE-2026-47526","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47526","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47526","date":"2026-11-09","epss":0.0012,"percentile":0.01877}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47526"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47526","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47531","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47531","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47531","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47531","date":"2026-11-09","epss":0.0012,"percentile":0.01877}],"risk":0.06,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47531"},"relatedVulnerabilities":[{"id":"CVE-2026-47531","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47531","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47531","date":"2026-11-09","epss":0.0012,"percentile":0.01877}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47531"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47531","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause a null pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47591","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47591","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47591","cwe":"CWE-863","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47591","date":"2026-11-09","epss":0.0012,"percentile":0.01858}],"risk":0.06,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47591"},"relatedVulnerabilities":[{"id":"CVE-2026-47591","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47591","cwe":"CWE-863","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47591","date":"2026-11-09","epss":0.0012,"percentile":0.01858}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47591"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47591","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47597","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47597","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47597","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47597","date":"2026-11-09","epss":0.00117,"percentile":0.01692}],"risk":0.0585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47597"},"relatedVulnerabilities":[{"id":"CVE-2026-47597","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47597","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47597","date":"2026-11-09","epss":0.00117,"percentile":0.01692}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47597"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47597","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module Resource Server where an unprivileged local user could cause a use-after-free through a missing self-reference guard in the map cleanup path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47595","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47595","date":"2026-11-09","epss":0.00117,"percentile":0.01682}],"risk":0.0585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47595"},"relatedVulnerabilities":[{"id":"CVE-2026-47595","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47595","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47595","date":"2026-11-09","epss":0.00117,"percentile":0.01682}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47595"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47595","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47496","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47496","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47496","date":"2026-11-09","epss":0.00117,"percentile":0.01672}],"risk":0.0585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47496"},"relatedVulnerabilities":[{"id":"CVE-2026-47496","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47496","cwe":"CWE-787","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47496","date":"2026-11-09","epss":0.00117,"percentile":0.01672}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47496"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47496","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC call to the host. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, and denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47517","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47517","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47517","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47517","date":"2026-11-09","epss":0.00115,"percentile":0.01545}],"risk":0.057499999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47517"},"relatedVulnerabilities":[{"id":"CVE-2026-47517","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47517","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47517","date":"2026-11-09","epss":0.00115,"percentile":0.01545}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47517"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47517","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode driver where a local user may cause a null pointer dereference by submitting a crafted ioctl. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47549","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47549","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47549","date":"2026-11-09","epss":0.00115,"percentile":0.01545}],"risk":0.057499999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47549"},"relatedVulnerabilities":[{"id":"CVE-2026-47549","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47549","cwe":"CWE-476","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47549","date":"2026-11-09","epss":0.00115,"percentile":0.01545}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47549"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47549","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel module where an unprivileged local user could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"c45a2e205b370ab5","cpes":["cpe:2.3:a:dash:dash:0.5.11\\+git20210903\\+057cd650a4ed-3build1:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/ubuntu/dash@0.5.11%2Bgit20210903%2B057cd650a4ed-3build1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"0.5.11+git20210903+057cd650a4ed-3build1","language":"","licenses":["BSD-3-Clause","BSD-3-clause","Expat","FSFUL","FSFULLR","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.config","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.config"},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.prerm"},{"path":"/var/lib/dpkg/info/dash.templates","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.templates"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102474","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"dash","version":"0.5.11+git20210903+057cd650a4ed-3build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-102474","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-11-09","epss":0.00113,"percentile":0.01422}],"risk":0.056499999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102474"},"relatedVulnerabilities":[{"id":"CVE-2026-102474","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-11-09","epss":0.00113,"percentile":0.01422}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102474","https://bugzilla.redhat.com/show_bug.cgi?id=2543004"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102474","description":"A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \\u or \\U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47567","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47567","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47567","cwe":"CWE-400","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47567","date":"2026-11-09","epss":0.00112,"percentile":0.01403}],"risk":0.055999999999999994,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47567"},"relatedVulnerabilities":[{"id":"CVE-2026-47567","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47567","cwe":"CWE-400","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47567","date":"2026-11-09","epss":0.00112,"percentile":0.01403}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47567"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47567","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontrolled resource consumption by exhausting the DRM VMA offset address space. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47568","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47568","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47568","cwe":"CWE-400","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47568","date":"2026-11-09","epss":0.00112,"percentile":0.01403}],"risk":0.055999999999999994,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47568"},"relatedVulnerabilities":[{"id":"CVE-2026-47568","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47568","cwe":"CWE-400","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47568","date":"2026-11-09","epss":0.00112,"percentile":0.01403}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47568"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47568","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrolled kernel log generation by repeatedly invoking an interface that emits unrate-limited error messages. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47598","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47598","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47598","date":"2026-11-09","epss":0.00112,"percentile":0.01365}],"risk":0.055999999999999994,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47598"},"relatedVulnerabilities":[{"id":"CVE-2026-47598","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47598","cwe":"CWE-416","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47598","date":"2026-11-09","epss":0.00112,"percentile":0.01365}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47598"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47598","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module event delivery path where an unprivileged local user could cause a use-after-free through a race between asynchronous event delivery and file close. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47602","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47602","cwe":"CWE-119","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47602","date":"2026-11-09","epss":0.00111,"percentile":0.01356}],"risk":0.05550000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47602"},"relatedVulnerabilities":[{"id":"CVE-2026-47602","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47602","cwe":"CWE-119","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47602","date":"2026-11-09","epss":0.00111,"percentile":0.01356}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47602"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47602","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver to dereference an untrusted pointer. A successful exploit of this vulnerability might lead to denial of service and information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47492","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47492","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47492","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47492","date":"2026-11-09","epss":0.00111,"percentile":0.01318}],"risk":0.05550000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47492"},"relatedVulnerabilities":[{"id":"CVE-2026-47492","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47492","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47492","date":"2026-11-09","epss":0.00111,"percentile":0.01318}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47492"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47492","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47599","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47599","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47599","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47599","date":"2026-11-09","epss":0.0011,"percentile":0.01279}],"risk":0.055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47599"},"relatedVulnerabilities":[{"id":"CVE-2026-47599","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47599","cwe":"CWE-281","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47599","date":"2026-11-09","epss":0.0011,"percentile":0.01279}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47599"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47599","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module where an unprivileged local user could cause improper preservation of memory access permissions during DMA mapping. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47562","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47562","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47562","cwe":"CWE-116","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47562","date":"2026-11-09","epss":0.0011,"percentile":0.01261}],"risk":0.055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47562"},"relatedVulnerabilities":[{"id":"CVE-2026-47562","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47562","cwe":"CWE-116","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47562","date":"2026-11-09","epss":0.0011,"percentile":0.01261}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47562"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47562","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data tampering."}]},{"artifact":{"id":"e357b084689acf02","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:249.11-0ubuntu3.23:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@249.11-0ubuntu3.23?arch=amd64&distro=ubuntu-22.04&upstream=systemd","type":"deb","version":"249.11-0ubuntu3.23","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"systemd","version":"249.11-0ubuntu3.23"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-40228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-09","epss":0.0018,"percentile":0.07587}],"risk":0.054,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-40228"},"relatedVulnerabilities":[{"id":"CVE-2026-40228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-09","epss":0.0018,"percentile":0.07587}],"urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."}]},{"artifact":{"id":"8e649a2783e155bc","cpes":["cpe:2.3:a:libudev1:libudev1:249.11-0ubuntu3.23:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@249.11-0ubuntu3.23?arch=amd64&distro=ubuntu-22.04&upstream=systemd","type":"deb","version":"249.11-0ubuntu3.23","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"systemd","version":"249.11-0ubuntu3.23"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-40228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-09","epss":0.0018,"percentile":0.07587}],"risk":0.054,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-40228"},"relatedVulnerabilities":[{"id":"CVE-2026-40228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-11-09","epss":0.0018,"percentile":0.07587}],"urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."}]},{"artifact":{"id":"28fca543f57dcd6c","cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"gcc-12-base","purl":"pkg:deb/ubuntu/gcc-12-base@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gcc-12-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114690","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-114690","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-09","epss":0.00107,"percentile":0.01135}],"risk":0.0535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114690"},"relatedVulnerabilities":[{"id":"CVE-2026-114690","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-09","epss":0.00107,"percentile":0.01135}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114690","https://bugzilla.redhat.com/show_bug.cgi?id=2478652"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"8b00bd78062b4cf6","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114690","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-114690","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-09","epss":0.00107,"percentile":0.01135}],"risk":0.0535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114690"},"relatedVulnerabilities":[{"id":"CVE-2026-114690","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-09","epss":0.00107,"percentile":0.01135}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114690","https://bugzilla.redhat.com/show_bug.cgi?id=2478652"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"460ba69fd84f6da5","cpes":["cpe:2.3:a:libgomp1:libgomp1:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libgomp1","purl":"pkg:deb/ubuntu/libgomp1@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libgomp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114690","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-114690","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-09","epss":0.00107,"percentile":0.01135}],"risk":0.0535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114690"},"relatedVulnerabilities":[{"id":"CVE-2026-114690","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-09","epss":0.00107,"percentile":0.01135}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114690","https://bugzilla.redhat.com/show_bug.cgi?id=2478652"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"68ba2921acfec6fe","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.3.0-1ubuntu1\\~22.04.3:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@12.3.0-1ubuntu1~22.04.3?arch=amd64&distro=ubuntu-22.04&upstream=gcc-12","type":"deb","version":"12.3.0-1ubuntu1~22.04.3","language":"","licenses":["sha256:da8191658b3452ce9caf31638ba61dab31a38c619fa39df119812e050f592fd3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-12"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114690","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gcc-12","version":"12.3.0-1ubuntu1~22.04.3"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-114690","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-09","epss":0.00107,"percentile":0.01135}],"risk":0.0535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114690"},"relatedVulnerabilities":[{"id":"CVE-2026-114690","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114690","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114690","date":"2026-11-09","epss":0.00107,"percentile":0.01135}],"urls":["https://access.redhat.com/security/cve/CVE-2026-114690","https://bugzilla.redhat.com/show_bug.cgi?id=2478652"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114690","description":"A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47565","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47565","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47565","cwe":"CWE-362","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47565","date":"2026-11-09","epss":0.00104,"percentile":0.01018}],"risk":0.052,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47565"},"relatedVulnerabilities":[{"id":"CVE-2026-47565","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47565","cwe":"CWE-362","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47565","date":"2026-11-09","epss":0.00104,"percentile":0.01018}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47565"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47565","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a privileged user could trigger a race condition that leads to an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."}]},{"artifact":{"id":"3f7b6ec6ebe12456","cpes":["cpe:2.3:a:tar:tar:1.34\\+dfsg-1ubuntu0.1.22.04.6:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.34%2Bdfsg-1ubuntu0.1.22.04.6?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"1.34+dfsg-1ubuntu0.1.22.04.6","language":"","licenses":["sha256:5e07fa97dc98e502dc15d09d4c14647ec77509f949267a30d1341cadf84d629f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18477","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"tar","version":"1.34+dfsg-1ubuntu0.1.22.04.6"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-18477","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-11-09","epss":0.00104,"percentile":0.01008}],"risk":0.052,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18477"},"relatedVulnerabilities":[{"id":"CVE-2026-18477","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-11-09","epss":0.00104,"percentile":0.01008}],"urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."}]},{"artifact":{"id":"c45a2e205b370ab5","cpes":["cpe:2.3:a:dash:dash:0.5.11\\+git20210903\\+057cd650a4ed-3build1:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/ubuntu/dash@0.5.11%2Bgit20210903%2B057cd650a4ed-3build1?arch=amd64&distro=ubuntu-22.04","type":"deb","version":"0.5.11+git20210903+057cd650a4ed-3build1","language":"","licenses":["BSD-3-Clause","BSD-3-clause","Expat","FSFUL","FSFULLR","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.config","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.config"},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.prerm"},{"path":"/var/lib/dpkg/info/dash.templates","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/dash.templates"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"dash","version":"0.5.11+git20210903+057cd650a4ed-3build1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-102473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-11-09","epss":0.00102,"percentile":0.00936}],"risk":0.051000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102473"},"relatedVulnerabilities":[{"id":"CVE-2026-102473","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-11-09","epss":0.00102,"percentile":0.00936}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102473","https://bugzilla.redhat.com/show_bug.cgi?id=2543005"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102473","description":"A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."}]},{"artifact":{"id":"410ae421412cce83","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.15","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-09","epss":0.00102,"percentile":0.00932}],"risk":0.051000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-09","epss":0.00102,"percentile":0.00932}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"9338e29687b3d4ff","cpes":["cpe:2.3:a:libc6:libc6:2.35-0ubuntu3.15:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.35-0ubuntu3.15?arch=amd64&distro=ubuntu-22.04&upstream=glibc","type":"deb","version":"2.35-0ubuntu3.15","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"glibc","version":"2.35-0ubuntu3.15"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-09","epss":0.00102,"percentile":0.00932}],"risk":0.051000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-11-09","epss":0.00102,"percentile":0.00932}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47603","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47603","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47603","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47603","date":"2026-11-09","epss":0.001,"percentile":0.00852}],"risk":0.05,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47603"},"relatedVulnerabilities":[{"id":"CVE-2026-47603","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47603","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47603","date":"2026-11-09","epss":0.001,"percentile":0.00852}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47603"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47603","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47604","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47604","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47604","date":"2026-11-09","epss":0.001,"percentile":0.00852}],"risk":0.05,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47604"},"relatedVulnerabilities":[{"id":"CVE-2026-47604","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47604","cwe":"CWE-862","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47604","date":"2026-11-09","epss":0.001,"percentile":0.00852}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47604"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47604","description":"NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24199","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-24199","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-24199","cwe":"CWE-362","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24199","date":"2026-11-09","epss":0.00092,"percentile":0.00512}],"risk":0.046,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-24199"},"relatedVulnerabilities":[{"id":"CVE-2026-24199","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24199","cwe":"CWE-362","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-24199","date":"2026-11-09","epss":0.00092,"percentile":0.00512}],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24199","https://nvidia.custhelp.com/app/answers/detail/a_id/5821","https://www.cve.org/CVERecord?id=CVE-2026-24199"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24199","description":"NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where a user could cause a race condition by reordering compiler or processor memory instructions. A successful exploit of this vulnerability might lead to denial of service."}]},{"artifact":{"id":"87f26cc7e982cd64","cpes":["cpe:2.3:a:cuda-compat-12-9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12-9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12_9:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat-12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat_12:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda-compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda_compat:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda-compat-12-9:575.57.08-0ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cuda:cuda_compat_12_9:575.57.08-0ubuntu1:*:*:*:*:*:*:*"],"name":"cuda-compat-12-9","purl":"pkg:deb/ubuntu/cuda-compat-12-9@575.57.08-0ubuntu1?arch=amd64&distro=ubuntu-22.04&upstream=nvidia-graphics-drivers-575","type":"deb","version":"575.57.08-0ubuntu1","language":"","licenses":["GPL-2","GPL-2.0+","MIT","NVIDIA-graphics-drivers","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cuda-compat-12-9/copyright","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/usr/share/doc/cuda-compat-12-9/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.list","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.list"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.shlibs"},{"path":"/var/lib/dpkg/info/cuda-compat-12-9.triggers","layerID":"sha256:2f58442919fa6fc058366388cf4cf5cac69571b9e4100715a0659dcb3f2b464f","accessPath":"/var/lib/dpkg/info/cuda-compat-12-9.triggers"}],"upstreams":[{"name":"nvidia-graphics-drivers-575"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47554","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"nvidia-graphics-drivers-575","version":"575.57.08-0ubuntu1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-47554","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47554","cwe":"CWE-347","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47554","date":"2026-11-09","epss":0.00092,"percentile":0.00485}],"risk":0.046,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47554"},"relatedVulnerabilities":[{"id":"CVE-2026-47554","cvss":[{"type":"Secondary","source":"psirt@nvidia.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47554","cwe":"CWE-347","type":"Secondary","source":"psirt@nvidia.com"}],"epss":[{"cve":"CVE-2026-47554","date":"2026-11-09","epss":0.00092,"percentile":0.00485}],"urls":["https://github.com/NVIDIA/product-security/tree/main/2026/5861","https://www.cve.org/CVERecord?id=CVE-2026-47554"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47554","description":"NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signatures may cause signature verification to be bypassed under memory pressure. A successful exploit of this vulnerability might lead to denial of service and data tampering."}]},{"artifact":{"id":"bfd86512a80abb42","cpes":["cpe:2.3:a:libacl1:libacl1:2.3.1-1:*:*:*:*:*:*:*"],"name":"libacl1","purl":"pkg:deb/ubuntu/libacl1@2.3.1-1?arch=amd64&distro=ubuntu-22.04&upstream=acl","type":"deb","version":"2.3.1-1","language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:3cc982388b71ef357e0157e0b7d3059dcefa4dc9fd2e3815bde6c6ce040302f3","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"acl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"acl","version":"2.3.1-1"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-54370","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-54370","date":"2026-11-09","epss":0.00088,"percentile":0.00368}],"risk":0.044000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54370"},"relatedVulnerabilities":[{"id":"CVE-2026-54370","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-54370","date":"2026-11-09","epss":0.00088,"percentile":0.00368}],"urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54370","description":"acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation."}]},{"artifact":{"id":"2d995e9dbc2ddbc0","cpes":["cpe:2.3:a:dirmngr:dirmngr:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"dirmngr","purl":"pkg:deb/ubuntu/dirmngr@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dirmngr/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/dirmngr/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dirmngr.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.list"},{"path":"/var/lib/dpkg/info/dirmngr.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.postinst"},{"path":"/var/lib/dpkg/info/dirmngr.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.postrm"},{"path":"/var/lib/dpkg/info/dirmngr.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.preinst"},{"path":"/var/lib/dpkg/info/dirmngr.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/dirmngr.prerm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"87d85fc31d97759c","cpes":["cpe:2.3:a:gnupg:gnupg:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/ubuntu/gnupg@2.2.27-3ubuntu2.5?arch=all&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"21e433471ebcdd4c","cpes":["cpe:2.3:a:gnupg-l10n:gnupg-l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-l10n:gnupg_l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg-l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_l10n:gnupg_l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_l10n:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg-l10n","purl":"pkg:deb/ubuntu/gnupg-l10n@2.2.27-3ubuntu2.5?arch=all&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-l10n/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-l10n.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-l10n.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"4da066024d6bd485","cpes":["cpe:2.3:a:gnupg-utils:gnupg-utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg-utils:gnupg_utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg-utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg_utils:gnupg_utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg-utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gnupg:gnupg_utils:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg-utils","purl":"pkg:deb/ubuntu/gnupg-utils@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg-utils/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg-utils.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg-utils.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"be7029cb13ed57af","cpes":["cpe:2.3:a:gnupg2:gnupg2:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gnupg2","purl":"pkg:deb/ubuntu/gnupg2@2.2.27-3ubuntu2.5?arch=all&distro=ubuntu-22.04","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg2/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gnupg2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg2.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg2.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gnupg2.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"ac02a22afc1598d4","cpes":["cpe:2.3:a:gpg:gpg:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg","purl":"pkg:deb/ubuntu/gpg@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"77792b77bb0fcaba","cpes":["cpe:2.3:a:gpg-agent:gpg-agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-agent:gpg_agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg-agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_agent:gpg_agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_agent:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg-agent","purl":"pkg:deb/ubuntu/gpg-agent@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-agent/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg-agent/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.conffiles","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-agent.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.list"},{"path":"/var/lib/dpkg/info/gpg-agent.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.postinst"},{"path":"/var/lib/dpkg/info/gpg-agent.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-agent.postrm"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"fe3c51f7337154a3","cpes":["cpe:2.3:a:gpg-wks-client:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks-client:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_client:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_client:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-wks-client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_wks_client:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg-wks-client","purl":"pkg:deb/ubuntu/gpg-wks-client@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-wks-client/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg-wks-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-client.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-client.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-client.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"bf862e676a9f55f3","cpes":["cpe:2.3:a:gpg-wks-server:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks-server:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_server:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks_server:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg-wks:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg_wks:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg-wks-server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:gpg:gpg_wks_server:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpg-wks-server","purl":"pkg:deb/ubuntu/gpg-wks-server@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg-wks-server/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpg-wks-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-server.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg-wks-server.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpg-wks-server.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"5c6a194c9301a444","cpes":["cpe:2.3:a:gpgconf:gpgconf:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpgconf","purl":"pkg:deb/ubuntu/gpgconf@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgconf/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpgconf/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgconf.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgconf.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"5e7058fe04099641","cpes":["cpe:2.3:a:gpgsm:gpgsm:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpgsm","purl":"pkg:deb/ubuntu/gpgsm@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgsm/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpgsm/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgsm.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgsm.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgsm.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"2551cbcb93b2aea5","cpes":["cpe:2.3:a:gpgv:gpgv:2.2.27-3ubuntu2.5:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@2.2.27-3ubuntu2.5?arch=amd64&distro=ubuntu-22.04&upstream=gnupg2","type":"deb","version":"2.2.27-3ubuntu2.5","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"gnupg2","version":"2.2.27-3ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"risk":0.038400000000000004,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-11-09","epss":0.00128,"percentile":0.02494}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"e055751ea35a0539","cpes":["cpe:2.3:a:perl-base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.34.0-3ubuntu1.10:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.34.0-3ubuntu1.10?arch=amd64&distro=ubuntu-22.04&upstream=perl","type":"deb","version":"5.34.0-3ubuntu1.10","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:2b6c9092300fcf23f73d7ae2296ae85889d3f45a38d94a5465e24bae62db8bfe","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-47039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"22.04"},"package":{"name":"perl","version":"5.34.0-3ubuntu1.10"},"namespace":"ubuntu:distro:ubuntu:22.04"}}],"vulnerability":{"id":"CVE-2023-47039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-47039","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-47039","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-47039","date":"2026-11-09","epss":0.00417,"percentile":0.36285}],"risk":0.020850000000000004,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:22.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-47039"},"relatedVulnerabilities":[{"id":"CVE-2023-47039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-47039","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-47039","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-47039","date":"2026-11-09","epss":0.00417,"percentile":0.36285}],"urls":["https://access.redhat.com/security/cve/CVE-2023-47039","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746","https://bugzilla.redhat.com/show_bug.cgi?id=2249525","https://perldoc.perl.org/perl5382delta#CVE-2023-47039-Perl-for-Windows-binary-hijacking-vulnerability","https://security.netapp.com/advisory/ntap-20240208-0005/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-47039","description":"A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations."}]},{"artifact":{"id":"4fe210576cd3da29","cpes":["cpe:2.3:a:avro_project:avro:v2.29.0:*:*:*:*:go:*:*"],"name":"github.com/hamba/avro/v2","purl":"pkg:golang/github.com/hamba/avro/v2@v2.29.0","type":"go-module","version":"v2.29.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:fkqoWEPxfygZxrkktgSHEpd0j/P7RKTBTDbcEeMdVEY=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5048","versionConstraint":"none (unknown)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/hamba/avro/v2","version":"v2.29.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5048","fix":{"state":"","versions":[]},"cvss":[],"risk":0,"urls":["https://github.com/iskorotkov/avro/commit/5192df96a158999344ac96ebcb1f7461d626f6d7"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://github.com/iskorotkov/avro/security/advisories/GHSA-mx64-mj3q-7prj","description":"The Avro map decoder accepts attacker-controlled block-element counts from the wire format and grows the destination map without enforcing an upper bound. A producer can declare an arbitrarily large map (in one block, or chunked across many sub-limit blocks) and exhaust process memory until the OOM killer fires.\n\nThe fix introduces Config.MaxMapAllocSize with cumulative enforcement across block boundaries. The new limit is opt-in: the field defaults to zero, which preserves the previous unbounded behavior for backward compatibility. Upgrading to v2.33.0 alone does not mitigate the issue; consumers of untrusted Avro data must explicitly set MaxMapAllocSize on their avro.Config."},"relatedVulnerabilities":[{"id":"GHSA-mx64-mj3q-7prj","cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"urls":["https://github.com/iskorotkov/avro/security/advisories/GHSA-mx64-mj3q-7prj"],"severity":"High","namespace":"github:language:go","dataSource":"https://github.com/advisories/GHSA-mx64-mj3q-7prj","description":"iskorotkov/avro: Denial-of-Service Vulnerability in Decoder"}]},{"artifact":{"id":"a196e39a50a60957","cpes":["cpe:2.3:a:golang:crypto:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.57.0:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.57.0","type":"go-module","version":"v0.57.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/lib/libmilvus-planparser.so","layerID":"sha256:3656e3c7ecc57218ee32c4319d8ed51bc8687be2c866b2bf6a3c099f2bee9519","accessPath":"/milvus/lib/libmilvus-planparser.so","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.58.1-0.20261009181718-2f1f834330b2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"<0.58.1-0.20261009181718-2f1f834330b2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.57.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5932","fix":{"state":"fixed","versions":["0.58.1-0.20261009181718-2f1f834330b2"],"available":[{"date":"2026-10-09","kind":"release","version":"0.58.1-0.20261009181718-2f1f834330b2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81227"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/44226","description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package."},"relatedVulnerabilities":[]},{"artifact":{"id":"dc691563036cf3d8","cpes":["cpe:2.3:a:golang:crypto:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.57.0:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.57.0","type":"go-module","version":"v0.57.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=","mainModule":"github.com/milvus-io/milvus","architecture":"amd64","goCompiledVersion":"go1.26.9"},"locations":[{"path":"/milvus/bin/milvus","layerID":"sha256:4ac3620055ec1c359805bd061057c62c34c212dfe095f187c75b28040814a40b","accessPath":"/milvus/bin/milvus","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.58.1-0.20261009181718-2f1f834330b2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"<0.58.1-0.20261009181718-2f1f834330b2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.57.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5932","fix":{"state":"fixed","versions":["0.58.1-0.20261009181718-2f1f834330b2"],"available":[{"date":"2026-10-09","kind":"release","version":"0.58.1-0.20261009181718-2f1f834330b2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81227"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/44226","description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package."},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-11-11T05:20:28.132Z","grype_db_version":"2026-11-10T06:21:20.000Z"}