{"grype_matches":[{"artifact":{"id":"742d787e0b164278","cpes":["cpe:2.3:a:libgnutls30t64:libgnutls30t64:3.8.9-3\\+deb13u4:*:*:*:*:*:*:*"],"name":"libgnutls30t64","purl":"pkg:deb/debian/libgnutls30t64@3.8.9-3%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=gnutls28","type":"deb","version":"3.8.9-3+deb13u4","language":"","licenses":["sha256:a07e99815cf1998f1dabbc21fe199460bfa09b85ead0d56b49a32cac3d1791b5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgnutls30t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgnutls30t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gnutls28","version":"3.8.9-3+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-17","epss":0.73327,"percentile":0.9946}],"risk":3.66635,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-17","epss":0.73327,"percentile":0.9946}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"3283c74353a6fd98","cpes":["cpe:2.3:a:xdg-utils:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg-utils:xdg_utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg_utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg_utils:1.2.1-2:*:*:*:*:*:*:*"],"name":"xdg-utils","purl":"pkg:deb/debian/xdg-utils@1.2.1-2?arch=all&distro=debian-13.7","type":"deb","version":"1.2.1-2","language":"","licenses":["Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xdg-utils/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/xdg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/xdg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/xdg-utils.list"},{"path":"/var/lib/dpkg/info/xdg-utils.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/xdg-utils.postinst"},{"path":"/var/lib/dpkg/info/xdg-utils.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/xdg-utils.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-27748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"xdg-utils","version":"1.2.1-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2020-27748","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-27748","cwe":"CWE-201","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-27748","date":"2026-10-17","epss":0.01436,"percentile":0.727}],"risk":0.8256999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-27748","description":"A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird."},"relatedVulnerabilities":[{"id":"CVE-2020-27748","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-27748","cwe":"CWE-201","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2020-27748","date":"2026-10-17","epss":0.01436,"percentile":0.727}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1899769","https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-27748","description":"A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird."}]},{"artifact":{"id":"1e539cf5aec9013f","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66046","versionConstraint":"< 2.9.0-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-66046","fix":{"state":"fixed","versions":["2.9.0-1~deb13u1"],"available":[{"date":"2026-10-16","kind":"advisory","version":"2.9.0-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-10-17","epss":0.00742,"percentile":0.53792}],"risk":0.60102,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6566-1","link":"https://security-tracker.debian.org/tracker/DSA-6566-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-66046","description":"Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."},"relatedVulnerabilities":[{"id":"CVE-2026-66046","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66046","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66046","date":"2026-10-17","epss":0.00742,"percentile":0.53792}],"urls":["https://github.com/libexpat/libexpat/pull/1321","https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66046","description":"Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options."}]},{"artifact":{"id":"3a3de47e33e1d8aa","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/debian/libcairo-gobject2@1.18.4-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=cairo%401.18.4-1","type":"deb","version":"1.18.4-1+b1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo","version":"1.18.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cairo","version":"1.18.4-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-17","epss":0.01824,"percentile":0.78445}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-17","epss":0.01824,"percentile":0.78445}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"0522bb7de4d00cc0","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.4-1\\+b1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=cairo%401.18.4-1","type":"deb","version":"1.18.4-1+b1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcairo2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo","version":"1.18.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cairo","version":"1.18.4-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-17","epss":0.01824,"percentile":0.78445}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-17","epss":0.01824,"percentile":0.78445}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-6988","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-17","epss":0.01724,"percentile":0.77137}],"risk":0.5172,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."},"relatedVulnerabilities":[{"id":"CVE-2019-6988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-17","epss":0.01724,"percentile":0.77137}],"urls":["http://www.securityfocus.com/bid/106785","https://github.com/uclouvain/openjpeg/issues/1178"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."}]},{"artifact":{"id":"3283c74353a6fd98","cpes":["cpe:2.3:a:xdg-utils:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg-utils:xdg_utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg_utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg-utils:1.2.1-2:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg_utils:1.2.1-2:*:*:*:*:*:*:*"],"name":"xdg-utils","purl":"pkg:deb/debian/xdg-utils@1.2.1-2?arch=all&distro=debian-13.7","type":"deb","version":"1.2.1-2","language":"","licenses":["Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xdg-utils/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/xdg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/xdg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/xdg-utils.list"},{"path":"/var/lib/dpkg/info/xdg-utils.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/xdg-utils.postinst"},{"path":"/var/lib/dpkg/info/xdg-utils.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/xdg-utils.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-4055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"xdg-utils","version":"1.2.1-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2022-4055","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4055","cwe":"CWE-146","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2022-4055","date":"2026-10-17","epss":0.00678,"percentile":0.51374}],"risk":0.50511,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked."},"relatedVulnerabilities":[{"id":"CVE-2022-4055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4055","cwe":"CWE-146","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2022-4055","date":"2026-10-17","epss":0.00678,"percentile":0.51374}],"urls":["https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/205#note_1494267"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked."}]},{"artifact":{"id":"56182221a173d843","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.7.0-3\\+deb13u3:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=arm64&distro=debian-13.7&upstream=tiff","type":"deb","version":"4.7.0-3+deb13u3","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-52490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tiff","version":"4.7.0-3+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-52490","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52490","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52490","date":"2026-10-17","epss":0.0051,"percentile":0.42264}],"risk":0.47940000000000005,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-52490","description":"An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c"},"relatedVulnerabilities":[{"id":"CVE-2026-52490","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-52490","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-52490","date":"2026-10-17","epss":0.0051,"percentile":0.42264}],"urls":["https://gist.github.com/okyfh/122c2d72e991a78c8af80a3af3be8671","https://gitlab.com/libtiff/libtiff/-/work_items/846"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-52490","description":"An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c"}]},{"artifact":{"id":"fb1cc646c716a53f","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.40.1-6%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-17","epss":0.0063,"percentile":0.49125}],"risk":0.47250000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.  Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.  Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-17","epss":0.0063,"percentile":0.49125}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"1e539cf5aec9013f","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"< 2.9.0-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"fixed","versions":["2.9.0-1~deb13u1"],"available":[{"date":"2026-10-16","kind":"advisory","version":"2.9.0-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-17","epss":0.00549,"percentile":0.44765}],"risk":0.43371,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6566-1","link":"https://security-tracker.debian.org/tracker/DSA-6566-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-17","epss":0.00549,"percentile":0.44765}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"6819d24244f2b73c","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-2\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/debian/libsndfile1@1.2.2-2%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=libsndfile","type":"deb","version":"1.2.2-2+deb13u1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-37555","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libsndfile","version":"1.2.2-2+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-37555","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-37555","date":"2026-10-17","epss":0.00504,"percentile":0.41784}],"risk":0.39564,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-37555","description":"An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065."},"relatedVulnerabilities":[{"id":"CVE-2026-37555","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-37555","date":"2026-10-17","epss":0.00504,"percentile":0.41784}],"urls":["https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0ef2bfcc1","https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151","https://github.com/libsndfile/libsndfile/issues/833","https://access.redhat.com/errata/RHSA-2026:19559","https://access.redhat.com/errata/RHSA-2026:19560","https://access.redhat.com/errata/RHSA-2026:19610","https://access.redhat.com/errata/RHSA-2026:23221","https://access.redhat.com/errata/RHSA-2026:23222","https://access.redhat.com/errata/RHSA-2026:23223","https://access.redhat.com/errata/RHSA-2026:25092","https://access.redhat.com/errata/RHSA-2026:25197","https://access.redhat.com/errata/RHSA-2026:25198","https://access.redhat.com/errata/RHSA-2026:25227","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/security/cve/CVE-2026-37555","https://bugzilla.redhat.com/show_bug.cgi?id=2463856","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-37555","description":"An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110152","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110152","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"risk":0.37758,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110152","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567736859"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110152","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110152","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"risk":0.37758,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110152","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567736859"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110152","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110152","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"risk":0.37758,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110152","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567736859"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110152","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110152","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"risk":0.37758,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110152","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567736859"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110152","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110152","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"risk":0.37758,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110152","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110152","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110152","date":"2026-10-17","epss":0.00406,"percentile":0.3335}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567736859"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110152","description":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-74860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-74860","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-10-17","epss":0.00447,"percentile":0.3747}],"risk":0.35760000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."},"relatedVulnerabilities":[{"id":"CVE-2026-74860","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74860","cwe":"CWE-763","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-74860","date":"2026-10-17","epss":0.00447,"percentile":0.3747}],"urls":["https://access.redhat.com/errata/RHSA-2026:64463","https://access.redhat.com/errata/RHSA-2026:71585","https://access.redhat.com/errata/RHSA-2026:71586","https://access.redhat.com/errata/RHSA-2026:71641","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:79357","https://access.redhat.com/errata/RHSA-2026:82939","https://access.redhat.com/security/cve/CVE-2026-74860","https://bugzilla.redhat.com/show_bug.cgi?id=2529697"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74860","description":"A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings."}]},{"artifact":{"id":"32e2516577af1ce8","cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"libncursesw6","purl":"pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=arm64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libncursesw6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-17","epss":0.00465,"percentile":0.38829}],"risk":0.35572499999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-17","epss":0.00465,"percentile":0.38829}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"109ce5d685f813c6","cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"libtinfo6","purl":"pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=arm64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libtinfo6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-17","epss":0.00465,"percentile":0.38829}],"risk":0.35572499999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-17","epss":0.00465,"percentile":0.38829}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"3f9378db54aaac9e","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-17","epss":0.00465,"percentile":0.38829}],"risk":0.35572499999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-17","epss":0.00465,"percentile":0.38829}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"a6728d83d34dc83a","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=arm64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-69720","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-17","epss":0.00465,"percentile":0.38829}],"risk":0.35572499999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."},"relatedVulnerabilities":[{"id":"CVE-2025-69720","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69720","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-69720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-69720","date":"2026-10-17","epss":0.00465,"percentile":0.38829}],"urls":["https://github.com/Cao-Wuhui/CVE-2025-69720","https://invisible-island.net/archives/ncurses/6.5/","https://invisible-island.net/ncurses/","https://marc.info/?l=ncurses-bug&m=176539968328570&w=2","https://marc.info/?l=ncurses-bug&m=176540731801330&w=2","https://marc.info/?l=ncurses-bug&m=176545557728083&w=2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69720","description":"The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-17","epss":0.00666,"percentile":0.50861}],"risk":0.34299,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-17","epss":0.00666,"percentile":0.50861}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-17","epss":0.00666,"percentile":0.50861}],"risk":0.34299,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-17","epss":0.00666,"percentile":0.50861}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-17","epss":0.00666,"percentile":0.50861}],"risk":0.34299,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-17","epss":0.00666,"percentile":0.50861}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-39329","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-17","epss":0.00588,"percentile":0.47018}],"risk":0.33809999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2023-39329","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-17","epss":0.00588,"percentile":0.47018}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39329","https://bugzilla.redhat.com/show_bug.cgi?id=2295816","https://github.com/uclouvain/openjpeg/issues/1474"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."}]},{"artifact":{"id":"fb1cc646c716a53f","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.40.1-6%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-17","epss":0.00448,"percentile":0.37546}],"risk":0.33599999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.  _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.  A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-17","epss":0.00448,"percentile":0.37546}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-6653","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6653","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6653","cwe":"CWE-416","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-6653","cwe":"CWE-611","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-6653","date":"2026-10-17","epss":0.00355,"percentile":0.27688}],"risk":0.33370000000000005,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6653","description":"Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling."},"relatedVulnerabilities":[{"id":"CVE-2026-6653","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6653","cwe":"CWE-416","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-6653","cwe":"CWE-611","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-6653","date":"2026-10-17","epss":0.00355,"percentile":0.27688}],"urls":["https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6653","description":"Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling."}]},{"artifact":{"id":"1e539cf5aec9013f","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"< 2.9.0-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"fixed","versions":["2.9.0-1~deb13u1"],"available":[{"date":"2026-10-16","kind":"advisory","version":"2.9.0-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-17","epss":0.00403,"percentile":0.33053}],"risk":0.32642999999999994,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6566-1","link":"https://security-tracker.debian.org/tracker/DSA-6566-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-17","epss":0.00403,"percentile":0.33053}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110161","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110161","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"risk":0.3161999999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110161","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568826881"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110161","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110161","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"risk":0.3161999999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110161","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568826881"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110161","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110161","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"risk":0.3161999999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110161","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568826881"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110161","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110161","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"risk":0.3161999999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110161","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568826881"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110161","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110161","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"risk":0.3161999999999999,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110161","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110161","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110161","date":"2026-10-17","epss":0.0034,"percentile":0.2593}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568826881"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110161","description":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Critical)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110136","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110136","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110136","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719364"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110142","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110142","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110142","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/553525515"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110149","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110149","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110149","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568437149"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110136","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110136","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110136","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719364"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110142","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110142","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110142","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/553525515"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110149","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110149","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110149","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568437149"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110136","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110136","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110136","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719364"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110142","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110142","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110142","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/553525515"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110149","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110149","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110149","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568437149"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110136","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110136","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110136","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719364"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110142","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110142","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110142","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/553525515"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110149","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110149","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110149","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568437149"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110136","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110136","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110136","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110136","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110136","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719364"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110136","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110142","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110142","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110142","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110142","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110142","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/553525515"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110142","description":"Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110149","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110149","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"risk":0.31433999999999995,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110149","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110149","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110149","date":"2026-10-17","epss":0.00338,"percentile":0.25654}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568437149"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110149","description":"Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110137","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110137","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"risk":0.31214500000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561997899"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110137","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110137","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"risk":0.31214500000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561997899"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110137","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110137","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"risk":0.31214500000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561997899"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110137","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110137","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"risk":0.31214500000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561997899"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110137","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110137","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"risk":0.31214500000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110137","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110137","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110137","date":"2026-10-17","epss":0.00383,"percentile":0.30734}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561997899"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110137","description":"Use after free in WebRTC in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"6819d24244f2b73c","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-2\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/debian/libsndfile1@1.2.2-2%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=libsndfile","type":"deb","version":"1.2.2-2+deb13u1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-50613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libsndfile","version":"1.2.2-2+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-50613","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50613","date":"2026-10-17","epss":0.0054,"percentile":0.44227}],"risk":0.3105,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close."},"relatedVulnerabilities":[{"id":"CVE-2024-50613","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50613","date":"2026-10-17","epss":0.0054,"percentile":0.44227}],"urls":["https://github.com/libsndfile/libsndfile/issues/1034"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-17","epss":0.00521,"percentile":0.42967}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-17","epss":0.00521,"percentile":0.42967}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-17","epss":0.00521,"percentile":0.42967}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-17","epss":0.00521,"percentile":0.42967}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-17","epss":0.00521,"percentile":0.42967}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-17","epss":0.00521,"percentile":0.42967}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-17","epss":0.00521,"percentile":0.42967}],"risk":0.309995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-17","epss":0.00521,"percentile":0.42967}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-17","epss":0.00424,"percentile":0.35223}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-17","epss":0.00424,"percentile":0.35223}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-17","epss":0.00424,"percentile":0.35223}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-17","epss":0.00424,"percentile":0.35223}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-17","epss":0.00424,"percentile":0.35223}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-17","epss":0.00424,"percentile":0.35223}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-17","epss":0.00424,"percentile":0.35223}],"risk":0.30951999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-17","epss":0.00424,"percentile":0.35223}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"9ed089442b281a2c","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.7.0-5:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/debian/libpam-modules@1.7.0-5?arch=arm64&distro=debian-13.7&upstream=pam","type":"deb","version":"1.7.0-5","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-modules:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-modules:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"pam","version":"1.7.0-5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-17","epss":0.005,"percentile":0.41482}],"risk":0.2975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-17","epss":0.005,"percentile":0.41482}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"f4ac2f7253270f45","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.7.0-5:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/debian/libpam-modules-bin@1.7.0-5?arch=arm64&distro=debian-13.7&upstream=pam","type":"deb","version":"1.7.0-5","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"pam","version":"1.7.0-5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-17","epss":0.005,"percentile":0.41482}],"risk":0.2975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-17","epss":0.005,"percentile":0.41482}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"eb5873c5c35e21b8","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.7.0-5:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.7.0-5:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/debian/libpam-runtime@1.7.0-5?arch=all&distro=debian-13.7&upstream=pam","type":"deb","version":"1.7.0-5","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"pam","version":"1.7.0-5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-17","epss":0.005,"percentile":0.41482}],"risk":0.2975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-17","epss":0.005,"percentile":0.41482}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"e350147cbbbdff3f","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.7.0-5:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/debian/libpam0g@1.7.0-5?arch=arm64&distro=debian-13.7&upstream=pam","type":"deb","version":"1.7.0-5","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL-1","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libpam0g:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"pam","version":"1.7.0-5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54411","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-17","epss":0.005,"percentile":0.41482}],"risk":0.2975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."},"relatedVulnerabilities":[{"id":"CVE-2026-54411","cvss":[{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54411","cwe":"CWE-208","type":"Secondary","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}],"epss":[{"cve":"CVE-2026-54411","date":"2026-10-17","epss":0.005,"percentile":0.41482}],"urls":["https://cwe.mitre.org/data/definitions/208.html","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h","https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54411","description":"Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."}]},{"artifact":{"id":"6819d24244f2b73c","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-2\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/debian/libsndfile1@1.2.2-2%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=libsndfile","type":"deb","version":"1.2.2-2+deb13u1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libsndfile1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88372","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libsndfile","version":"1.2.2-2+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-88372","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88372","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88372","date":"2026-10-17","epss":0.0039,"percentile":0.3152}],"risk":0.2925,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88372","description":"libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files."},"relatedVulnerabilities":[{"id":"CVE-2026-88372","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88372","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88372","date":"2026-10-17","epss":0.0039,"percentile":0.3152}],"urls":["https://github.com/libsndfile/libsndfile/issues/1151"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88372","description":"libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5435","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-5435","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-17","epss":0.00394,"percentile":0.32061}],"risk":0.29156,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."},"relatedVulnerabilities":[{"id":"CVE-2026-5435","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-17","epss":0.00394,"percentile":0.32061}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34033","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5435","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-5435","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-17","epss":0.00394,"percentile":0.32061}],"risk":0.29156,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."},"relatedVulnerabilities":[{"id":"CVE-2026-5435","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-17","epss":0.00394,"percentile":0.32061}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34033","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5435","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-5435","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-17","epss":0.00394,"percentile":0.32061}],"risk":0.29156,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."},"relatedVulnerabilities":[{"id":"CVE-2026-5435","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-17","epss":0.00394,"percentile":0.32061}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34033","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5435","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-5435","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-17","epss":0.00394,"percentile":0.32061}],"risk":0.29156,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."},"relatedVulnerabilities":[{"id":"CVE-2026-5435","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5435","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5435","date":"2026-10-17","epss":0.00394,"percentile":0.32061}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34033","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5435","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-17","epss":0.05804,"percentile":0.93041}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-17","epss":0.05804,"percentile":0.93041}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-17","epss":0.05804,"percentile":0.93041}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-17","epss":0.05804,"percentile":0.93041}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-17","epss":0.05804,"percentile":0.93041}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-17","epss":0.05804,"percentile":0.93041}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-17","epss":0.05804,"percentile":0.93041}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-10-17","epss":0.05804,"percentile":0.93041}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-17","epss":0.00561,"percentile":0.45528}],"risk":0.28891500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-17","epss":0.00561,"percentile":0.45528}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-17","epss":0.00561,"percentile":0.45528}],"risk":0.28891500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-17","epss":0.00561,"percentile":0.45528}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-17","epss":0.00561,"percentile":0.45528}],"risk":0.28891500000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-17","epss":0.00561,"percentile":0.45528}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110165","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110165","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"risk":0.28551,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110165","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568827293"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110165","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110165","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"risk":0.28551,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110165","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568827293"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110165","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110165","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"risk":0.28551,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110165","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568827293"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110165","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110165","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"risk":0.28551,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110165","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568827293"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110165","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110165","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"risk":0.28551,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110165","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110165","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110165","date":"2026-10-17","epss":0.00307,"percentile":0.2201}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568827293"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110165","description":"Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"e13136159fee6ca0","cpes":["cpe:2.3:a:libminizip1t64:libminizip1t64:1\\:1.3.dfsg\\+really1.3.1-1\\+b1:*:*:*:*:*:*:*"],"name":"libminizip1t64","purl":"pkg:deb/debian/libminizip1t64@1%3A1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=zlib%401%3A1.3.dfsg%2Breally1.3.1-1","type":"deb","version":"1:1.3.dfsg+really1.3.1-1+b1","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libminizip1t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libminizip1t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libminizip1t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libminizip1t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-17","epss":0.00356,"percentile":0.27724}],"risk":0.28124,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-17","epss":0.00356,"percentile":0.27724}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"a314be46474190d8","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg\\+really1.3.1-1\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=zlib%401%3A1.3.dfsg%2Breally1.3.1-1","type":"deb","version":"1:1.3.dfsg+really1.3.1-1+b1","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/zlib1g:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-17","epss":0.00356,"percentile":0.27724}],"risk":0.28124,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-17","epss":0.00356,"percentile":0.27724}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"56182221a173d843","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.7.0-3\\+deb13u3:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=arm64&distro=debian-13.7&upstream=tiff","type":"deb","version":"4.7.0-3+deb13u3","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16232","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tiff","version":"4.7.0-3+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-16232","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16232","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16232","date":"2026-10-17","epss":0.05584,"percentile":0.92793}],"risk":0.2792,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16232","description":"LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue"},"relatedVulnerabilities":[{"id":"CVE-2017-16232","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16232","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16232","date":"2026-10-17","epss":0.05584,"percentile":0.92793}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00041.html","http://packetstormsecurity.com/files/150896/LibTIFF-4.0.8-Memory-Leak.html","http://seclists.org/fulldisclosure/2018/Dec/32","http://seclists.org/fulldisclosure/2018/Dec/47","http://www.openwall.com/lists/oss-security/2017/11/01/11","http://www.openwall.com/lists/oss-security/2017/11/01/3","http://www.openwall.com/lists/oss-security/2017/11/01/7","http://www.openwall.com/lists/oss-security/2017/11/01/8","http://www.securityfocus.com/bid/101696"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16232","description":"LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110916","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110916","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"risk":0.27807,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110916","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/501886301"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110916","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110916","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"risk":0.27807,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110916","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/501886301"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110916","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110916","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"risk":0.27807,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110916","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/501886301"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110916","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110916","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"risk":0.27807,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110916","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/501886301"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110916","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110916","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"risk":0.27807,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110916","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110916","cwe":"CWE-20","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110916","date":"2026-10-17","epss":0.00299,"percentile":0.21157}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/501886301"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110916","description":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110155","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110155","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"risk":0.276285,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110155","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167922"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110155","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110155","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"risk":0.276285,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110155","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167922"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110155","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110155","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"risk":0.276285,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110155","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167922"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110155","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110155","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"risk":0.276285,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110155","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167922"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110155","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110155","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"risk":0.276285,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110155","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110155","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110155","date":"2026-10-17","epss":0.00339,"percentile":0.2576}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167922"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110155","description":"Buffer overflow in PDFium in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"968cab04caa47ab3","cpes":["cpe:2.3:a:gcc-14-base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14-base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*"],"name":"gcc-14-base","purl":"pkg:deb/debian/gcc-14-base@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/gcc-14-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-17","epss":0.00363,"percentile":0.28631}],"risk":0.27588,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-17","epss":0.00363,"percentile":0.28631}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"64d344f35c5fd422","cpes":["cpe:2.3:a:libatomic1:libatomic1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-17","epss":0.00363,"percentile":0.28631}],"risk":0.27588,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-17","epss":0.00363,"percentile":0.28631}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"138a9da489396cfc","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-17","epss":0.00363,"percentile":0.28631}],"risk":0.27588,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-17","epss":0.00363,"percentile":0.28631}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"436375387486e8f6","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:14.2.0-19:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-17","epss":0.00363,"percentile":0.28631}],"risk":0.27588,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-17","epss":0.00363,"percentile":0.28631}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-61915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-61915","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61915","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-61915","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-61915","date":"2026-10-17","epss":0.00462,"percentile":0.38681}],"risk":0.27026999999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15."},"relatedVulnerabilities":[{"id":"CVE-2025-61915","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.7,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":6,"impactScore":4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61915","cwe":"CWE-124","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-61915","cwe":"CWE-129","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-61915","date":"2026-10-17","epss":0.00462,"percentile":0.38681}],"urls":["https://github.com/OpenPrinting/cups/commit/db8d560262c22a21ee1e55dfd62fa98d9359bcb0","https://github.com/OpenPrinting/cups/releases/tag/v2.4.15","https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc","http://www.openwall.com/lists/oss-security/2025/11/27/5"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61915","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110157","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110157","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110157","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570047270"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110162","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110162","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110162","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/540499008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110157","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110157","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110157","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570047270"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110162","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110162","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110162","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/540499008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110157","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110157","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110157","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570047270"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110162","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110162","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110162","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/540499008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110157","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110157","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110157","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570047270"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110162","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110162","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110162","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/540499008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110157","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110157","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110157","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110157","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110157","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570047270"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110157","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110162","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110162","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110162","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110162","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110162","date":"2026-10-17","epss":0.0033,"percentile":0.24586}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/540499008"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110162","description":"Use after free in Desktop in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110163","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110163","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110163","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568831102"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110163","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110163","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110163","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568831102"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110163","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110163","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110163","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568831102"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110163","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110163","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110163","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568831102"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110163","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110163","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110163","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110163","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110163","date":"2026-10-17","epss":0.0033,"percentile":0.24585}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568831102"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110163","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110140","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110140","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562038980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110140","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110140","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562038980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110140","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110140","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562038980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110140","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110140","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562038980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110140","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110140","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"risk":0.26895,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110140","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110140","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110140","date":"2026-10-17","epss":0.0033,"percentile":0.24564}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562038980"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110140","description":"Type confusion in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39327","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-39327","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39327","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39327","date":"2026-10-17","epss":0.00555,"percentile":0.45111}],"risk":0.258075,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-39327","description":"A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal."},"relatedVulnerabilities":[{"id":"CVE-2023-39327","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39327","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39327","date":"2026-10-17","epss":0.00555,"percentile":0.45111}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39327","https://bugzilla.redhat.com/show_bug.cgi?id=2295812","https://github.com/uclouvain/openjpeg/issues/1472"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39327","description":"A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6238","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-17","epss":0.00444,"percentile":0.37126}],"risk":0.2553,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.  These functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."},"relatedVulnerabilities":[{"id":"CVE-2026-6238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-17","epss":0.00444,"percentile":0.37126}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34069","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6238","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-17","epss":0.00444,"percentile":0.37126}],"risk":0.2553,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.  These functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."},"relatedVulnerabilities":[{"id":"CVE-2026-6238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-17","epss":0.00444,"percentile":0.37126}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34069","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6238","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-17","epss":0.00444,"percentile":0.37126}],"risk":0.2553,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.  These functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."},"relatedVulnerabilities":[{"id":"CVE-2026-6238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-17","epss":0.00444,"percentile":0.37126}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34069","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6238","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-17","epss":0.00444,"percentile":0.37126}],"risk":0.2553,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.  These functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."},"relatedVulnerabilities":[{"id":"CVE-2026-6238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-10-17","epss":0.00444,"percentile":0.37126}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34069","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110158","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110158","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"risk":0.25517,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110158","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562242421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110158","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110158","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"risk":0.25517,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110158","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562242421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110158","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110158","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"risk":0.25517,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110158","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562242421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110158","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110158","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"risk":0.25517,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110158","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562242421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110158","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110158","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"risk":0.25517,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110158","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110158","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110158","date":"2026-10-17","epss":0.00323,"percentile":0.2377}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562242421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110158","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34980","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34980","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34980","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34980","date":"2026-10-17","epss":0.00335,"percentile":0.25382}],"risk":0.25125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34980","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches."},"relatedVulnerabilities":[{"id":"CVE-2026-34980","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34980","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34980","date":"2026-10-17","epss":0.00335,"percentile":0.25382}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-4852-v58g-6cwf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34980","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server accepts a page-border value supplied as textWithoutLanguage, preserves an embedded newline through option escaping and reparse, and then reparses the resulting second-line PPD: text as a trusted scheduler control record. A follow-up raw print job can therefore make the server execute an attacker-chosen existing binary such as /usr/bin/vim as lp. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110166","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110166","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"risk":0.25102,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110166","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/566496747"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110166","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110166","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"risk":0.25102,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110166","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/566496747"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110166","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110166","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"risk":0.25102,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110166","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/566496747"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110166","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110166","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"risk":0.25102,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110166","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/566496747"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110166","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110166","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"risk":0.25102,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110166","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110166","cwe":"CWE-122","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110166","date":"2026-10-17","epss":0.00308,"percentile":0.22101}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/566496747"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110166","description":"Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110147","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110147","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110147","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050928"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110151","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110151","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110151","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570638834"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110154","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110154","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110154","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167920"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110147","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110147","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110147","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050928"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110151","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110151","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110151","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570638834"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110154","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110154","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110154","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167920"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110147","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110147","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110147","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050928"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110151","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110151","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110151","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570638834"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110154","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110154","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110154","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167920"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110147","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110147","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110147","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050928"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110151","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110151","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110151","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570638834"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110154","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110154","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110154","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167920"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110147","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110147","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110147","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110147","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110147","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050928"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110147","description":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110151","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110151","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110151","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110151","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110151","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570638834"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110151","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110154","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110154","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110154","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110154","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110154","date":"2026-10-17","epss":0.00303,"percentile":0.21513}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570167920"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110154","description":"Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110139","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110139","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110139","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568037533"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110148","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110148","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050934"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110153","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110153","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110153","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565742182"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110139","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110139","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110139","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568037533"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110148","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110148","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050934"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110153","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110153","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110153","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565742182"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110139","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110139","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110139","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568037533"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110148","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110148","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050934"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110153","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110153","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110153","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565742182"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110139","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110139","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110139","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568037533"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110148","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110148","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050934"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110153","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110153","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110153","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565742182"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110139","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110139","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110139","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110139","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110139","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568037533"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110139","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110148","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110148","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110148","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110148","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110148","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570050934"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110148","description":"Use after free in SVG in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110153","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110153","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110153","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110153","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110153","date":"2026-10-17","epss":0.00303,"percentile":0.21512}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565742182"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110153","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34978","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34978","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34978","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34978","date":"2026-10-17","epss":0.0042,"percentile":0.34817}],"risk":0.24149999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34978","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches."},"relatedVulnerabilities":[{"id":"CVE-2026-34978","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34978","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34978","date":"2026-10-17","epss":0.0042,"percentile":0.34817}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-f53q-7mxp-9gcr"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34978","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, the RSS notifier allows .. path traversal in notify-recipient-uri (e.g., rss:///../job.cache), letting a remote IPP client write RSS XML bytes outside CacheDir/rss (anywhere that is lp-writable). In particular, because CacheDir is group-writable by default (typically root:lp and mode 0770), the notifier (running as lp) can replace root-managed state files via temp-file + rename(). This PoC clobbers CacheDir/job.cache with RSS XML, and after restarting cupsd the scheduler fails to parse the job cache and previously queued jobs disappear. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110156","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110156","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"risk":0.23542000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561892119"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110156","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110156","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"risk":0.23542000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561892119"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110156","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110156","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"risk":0.23542000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561892119"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110156","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110156","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"risk":0.23542000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561892119"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110156","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110156","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"risk":0.23542000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110156","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110156","cwe":"CWE-706","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110156","date":"2026-10-17","epss":0.00298,"percentile":0.21037}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561892119"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110156","description":"Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110159","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110159","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"risk":0.23528999999999997,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110159","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/564573066"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110159","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110159","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"risk":0.23528999999999997,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110159","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/564573066"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110159","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110159","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"risk":0.23528999999999997,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110159","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/564573066"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110159","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110159","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"risk":0.23528999999999997,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110159","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/564573066"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110159","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110159","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"risk":0.23528999999999997,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110159","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110159","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110159","date":"2026-10-17","epss":0.00253,"percentile":0.15643}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/564573066"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110159","description":"Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110913","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110913","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"risk":0.23472,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110913","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/567638392"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110913","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110913","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"risk":0.23472,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110913","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/567638392"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110913","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110913","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"risk":0.23472,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110913","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/567638392"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110913","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110913","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"risk":0.23472,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110913","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/567638392"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110913","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110913","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"risk":0.23472,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110913","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110913","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110913","date":"2026-10-17","epss":0.00288,"percentile":0.19916}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/567638392"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110913","description":"Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110138","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110138","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110138","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568899705"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110145","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110145","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110145","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562243925"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110138","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110138","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110138","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568899705"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110145","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110145","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110145","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562243925"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110138","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110138","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110138","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568899705"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110145","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110145","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110145","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562243925"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110138","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110138","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110138","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568899705"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110145","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110145","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110145","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562243925"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110138","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110138","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110138","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110138","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110138","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568899705"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110138","description":"Use after free in ShapeDetection in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110145","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110145","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"risk":0.23384,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110145","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110145","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110145","date":"2026-10-17","epss":0.00296,"percentile":0.20813}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/562243925"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110145","description":"Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68471","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-17","epss":0.00405,"percentile":0.33257}],"risk":0.23287499999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."},"relatedVulnerabilities":[{"id":"CVE-2025-68471","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-17","epss":0.00405,"percentile":0.33257}],"urls":["https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1","https://github.com/avahi/avahi/issues/678","https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68471","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-17","epss":0.00405,"percentile":0.33257}],"risk":0.23287499999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."},"relatedVulnerabilities":[{"id":"CVE-2025-68471","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-17","epss":0.00405,"percentile":0.33257}],"urls":["https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1","https://github.com/avahi/avahi/issues/678","https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68471","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-17","epss":0.00405,"percentile":0.33257}],"risk":0.23287499999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."},"relatedVulnerabilities":[{"id":"CVE-2025-68471","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68471","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68471","date":"2026-10-17","epss":0.00405,"percentile":0.33257}],"urls":["https://github.com/avahi/avahi/commit/9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1","https://github.com/avahi/avahi/issues/678","https://github.com/avahi/avahi/security/advisories/GHSA-56rf-42xr-qmmg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68471","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending 2 unsolicited announcements with CNAME resource records 2 seconds apart."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61702","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-61702","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-10-17","epss":0.00452,"percentile":0.3783}],"risk":0.23278000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-61702","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[{"id":"CVE-2026-61702","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-10-17","epss":0.00452,"percentile":0.3783}],"urls":["https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3","https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61702","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-17","epss":0.00297,"percentile":0.20925}],"risk":0.22572,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.  Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.  At the time of publication, no network-facing application impact is known."},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-17","epss":0.00297,"percentile":0.20925}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-17","epss":0.00297,"percentile":0.20925}],"risk":0.22572,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.  Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.  At the time of publication, no network-facing application impact is known."},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-17","epss":0.00297,"percentile":0.20925}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-17","epss":0.00297,"percentile":0.20925}],"risk":0.22572,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.  Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.  At the time of publication, no network-facing application impact is known."},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-17","epss":0.00297,"percentile":0.20925}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-17","epss":0.00297,"percentile":0.20925}],"risk":0.22572,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.  Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.  At the time of publication, no network-facing application impact is known."},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-17","epss":0.00297,"percentile":0.20925}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"f499f08d29476b59","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/debian/bsdutils@1%3A2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"5b04db34143fea42","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"4d86b378bd1ba8a0","cpes":["cpe:2.3:a:liblastlog2-2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2-2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"liblastlog2-2","purl":"pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblastlog2-2/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/liblastlog2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"07893143e3072ef0","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libmount1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"c850ed71cb1cd4a9","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"0362ef5f6b4ac926","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"2244af12d576a7c4","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:4.16.0-2+really2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"49363d0f62517793","cpes":["cpe:2.3:a:mount:mount:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"5e047e01cd6216a7","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-3184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-3184","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"risk":0.22454000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."},"relatedVulnerabilities":[{"id":"CVE-2026-3184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3184","cwe":"CWE-289","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3184","date":"2026-10-17","epss":0.00436,"percentile":0.36478}],"urls":["https://access.redhat.com/errata/RHSA-2026:7180","https://access.redhat.com/security/cve/CVE-2026-3184","https://bugzilla.redhat.com/show_bug.cgi?id=2442570"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3184","description":"A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110167","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110167","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110167","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570461696"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110172","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110172","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110172","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719352"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110167","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110167","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110167","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570461696"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110172","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110172","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110172","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719352"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110167","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110167","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110167","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570461696"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110172","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110172","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110172","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719352"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110167","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110167","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110167","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570461696"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110172","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110172","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110172","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719352"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110167","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110167","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110167","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110167","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110167","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570461696"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110167","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110172","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110172","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110172","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110172","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110172","date":"2026-10-17","epss":0.00275,"percentile":0.18631}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568719352"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110172","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110164","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110164","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110164","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568730794"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110168","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110168","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568010382"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110169","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110169","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110169","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567088929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110171","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110171","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110171","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570675082"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110164","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110164","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110164","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568730794"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110168","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110168","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568010382"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110169","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110169","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110169","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567088929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110171","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110171","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110171","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570675082"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110164","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110164","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110164","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568730794"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110168","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110168","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568010382"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110169","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110169","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110169","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567088929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110171","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110171","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110171","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570675082"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110164","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110164","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110164","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568730794"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110168","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110168","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568010382"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110169","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110169","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110169","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567088929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110171","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110171","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110171","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570675082"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110164","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110164","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110164","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110164","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110164","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568730794"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110164","description":"Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110168","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110168","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110168","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110168","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110168","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/568010382"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110168","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110169","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110169","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110169","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110169","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110169","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/567088929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110169","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110171","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110171","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"risk":0.22412500000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110171","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110171","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110171","date":"2026-10-17","epss":0.00275,"percentile":0.1863}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/570675082"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110171","description":"Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68468","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-17","epss":0.0038,"percentile":0.30448}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."},"relatedVulnerabilities":[{"id":"CVE-2025-68468","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-17","epss":0.0038,"percentile":0.30448}],"urls":["https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a","https://github.com/avahi/avahi/issues/683","https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68468","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-17","epss":0.0038,"percentile":0.30448}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."},"relatedVulnerabilities":[{"id":"CVE-2025-68468","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-17","epss":0.0038,"percentile":0.30448}],"urls":["https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a","https://github.com/avahi/avahi/issues/683","https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68468","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-17","epss":0.0038,"percentile":0.30448}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."},"relatedVulnerabilities":[{"id":"CVE-2025-68468","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68468","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68468","date":"2026-10-17","epss":0.0038,"percentile":0.30448}],"urls":["https://github.com/avahi/avahi/commit/f66be13d7f31a3ef806d226bf8b67240179d309a","https://github.com/avahi/avahi/issues/683","https://github.com/avahi/avahi/security/advisories/GHSA-cp79-r4x9-vf52"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68468","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashed by sending unsolicited announcements containing CNAME resource records pointing it to resource records with short TTLs. As soon as they expire avahi-daemon crashes."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110914","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110914","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110914","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/563194341"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110914","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110914","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110914","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/563194341"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110914","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110914","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110914","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/563194341"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110914","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110914","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110914","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/563194341"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110914","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110914","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110914","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110914","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110914","date":"2026-10-17","epss":0.00268,"percentile":0.17686}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/563194341"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110914","description":"Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110915","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/556272421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110915","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/556272421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110915","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/556272421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110915","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/556272421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110915","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"risk":0.21842000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"},"relatedVulnerabilities":[{"id":"CVE-2026-110915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110915","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110915","date":"2026-10-17","epss":0.00268,"percentile":0.17685}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/556272421"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110915","description":"Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"1e539cf5aec9013f","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76956","versionConstraint":"< 2.9.0-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76956","fix":{"state":"fixed","versions":["2.9.0-1~deb13u1"],"available":[{"date":"2026-10-16","kind":"advisory","version":"2.9.0-1~deb13u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76956","cwe":"CWE-394","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76956","date":"2026-10-17","epss":0.00287,"percentile":0.19914}],"risk":0.21525,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6566-1","link":"https://security-tracker.debian.org/tracker/DSA-6566-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76956","description":"In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content."},"relatedVulnerabilities":[{"id":"CVE-2026-76956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76956","cwe":"CWE-394","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76956","date":"2026-10-17","epss":0.00287,"percentile":0.19914}],"urls":["https://github.com/libexpat/libexpat/pull/1326","https://github.com/libexpat/libexpat/pull/1329"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76956","description":"In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content."}]},{"artifact":{"id":"152a46b6370370c1","cpes":["cpe:2.3:a:libxrender1:libxrender1:1\\:0.9.12-1:*:*:*:*:*:*:*"],"name":"libxrender1","purl":"pkg:deb/debian/libxrender1@1%3A0.9.12-1?arch=arm64&distro=debian-13.7&upstream=libxrender","type":"deb","version":"1:0.9.12-1","language":"","licenses":["HPND-sell-variant"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxrender1/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxrender1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxrender1:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxrender1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxrender"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88807","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxrender","version":"1:0.9.12-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-88807","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-10-17","epss":0.0026,"percentile":0.16541}],"risk":0.21320000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients."},"relatedVulnerabilities":[{"id":"CVE-2026-88807","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-10-17","epss":0.0026,"percentile":0.16541}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34979","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34979","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34979","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34979","date":"2026-10-17","epss":0.00413,"percentile":0.34101}],"risk":0.212695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34979","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches."},"relatedVulnerabilities":[{"id":"CVE-2026-34979","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34979","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34979","date":"2026-10-17","epss":0.00413,"percentile":0.34101}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-6qxf-7jx6-86fh"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34979","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, there is a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attribute. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-41079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-41079","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41079","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41079","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41079","date":"2026-10-17","epss":0.00409,"percentile":0.33598}],"risk":0.21267999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-41079","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17."},"relatedVulnerabilities":[{"id":"CVE-2026-41079","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41079","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-41079","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-41079","date":"2026-10-17","epss":0.00409,"percentile":0.33598}],"urls":["https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080","https://github.com/OpenPrinting/cups/commit/d7fe0f521ff3b24676511e747b058362b9a20737","https://github.com/OpenPrinting/cups/security/advisories/GHSA-6wpw-g8g6-wvrv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41079","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent attacker can send a crafted SNMP response to the CUPS SNMP backend that causes an out-of-bounds read of up to 176 bytes past a stack buffer. The leaked memory is converted from UTF-16 to UTF-8 and stored as printer supply description strings, which are subsequently visible to authenticated users via IPP Get-Printer-Attributes responses and the CUPS web interface. This vulnerability is fixed in 2.4.17."}]},{"artifact":{"id":"44ddb5684c898749","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-3.1:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=arm64&distro=debian-13.7","type":"deb","version":"1.35+dfsg-3.1","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5704","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tar","version":"1.35+dfsg-3.1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-17","epss":0.00401,"percentile":0.32822}],"risk":0.210525,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."},"relatedVulnerabilities":[{"id":"CVE-2026-5704","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-10-17","epss":0.00401,"percentile":0.32822}],"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110922","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110922","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"risk":0.20212000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110922","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568719351"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110922","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110922","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"risk":0.20212000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110922","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568719351"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110922","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110922","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"risk":0.20212000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110922","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568719351"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110922","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110922","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"risk":0.20212000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110922","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568719351"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110922","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110922","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"risk":0.20212000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"},"relatedVulnerabilities":[{"id":"CVE-2026-110922","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110922","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110922","date":"2026-10-17","epss":0.00248,"percentile":0.15}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568719351"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110922","description":"Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}]},{"artifact":{"id":"44ddb5684c898749","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-3.1:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/debian/tar@1.35%2Bdfsg-3.1?arch=arm64&distro=debian-13.7","type":"deb","version":"1.35+dfsg-3.1","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2005-2541","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tar","version":"1.35+dfsg-3.1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2005-2541","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-10-17","epss":0.03992,"percentile":0.9039}],"risk":0.1996,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."},"relatedVulnerabilities":[{"id":"CVE-2005-2541","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2005-2541","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2005-2541","date":"2026-10-17","epss":0.03992,"percentile":0.9039}],"urls":["http://marc.info/?l=bugtraq&m=112327628230258&w=2","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2005-2541","description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"risk":0.19511,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-17","epss":0.00358,"percentile":0.28039}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"1e539cf5aec9013f","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"< 2.9.0-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"fixed","versions":["2.9.0-1~deb13u1"],"available":[{"date":"2026-10-16","kind":"advisory","version":"2.9.0-1~deb13u1"}]},"cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-17","epss":0.00348,"percentile":0.26874}],"risk":0.18966000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6566-1","link":"https://security-tracker.debian.org/tracker/DSA-6566-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-17","epss":0.00348,"percentile":0.26874}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-8166","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2014-8166","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-8166","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-8166","date":"2026-10-17","epss":0.03703,"percentile":0.89599}],"risk":0.18515,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-8166","description":"The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name."},"relatedVulnerabilities":[{"id":"CVE-2014-8166","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-8166","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-8166","date":"2026-10-17","epss":0.03703,"percentile":0.89599}],"urls":["http://www.openwall.com/lists/oss-security/2015/03/24/15","http://www.openwall.com/lists/oss-security/2015/03/24/2","http://www.securityfocus.com/bid/73300","https://bugzilla.redhat.com/show_bug.cgi?id=1084577"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-8166","description":"The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might allow remote attackers to execute arbitrary code via a crafted printer name."}]},{"artifact":{"id":"25c630190e191390","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.2-1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/debian/libxi6@2%3A1.8.2-1?arch=arm64&distro=debian-13.7&upstream=libxi","type":"deb","version":"2:1.8.2-1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxi6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxi","version":"2:1.8.2-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93543","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93543","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93543","date":"2026-10-17","epss":0.00246,"percentile":0.1473}],"risk":0.18327000000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93543","description":"An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."},"relatedVulnerabilities":[{"id":"CVE-2026-93543","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93543","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93543","date":"2026-10-17","epss":0.00246,"percentile":0.1473}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=e2089ab748828273f916bbffd4e65b506aa50fdc"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93543","description":"An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87875","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-87875","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-17","epss":0.00392,"percentile":0.31769}],"risk":0.18228,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."},"relatedVulnerabilities":[{"id":"CVE-2026-87875","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-17","epss":0.00392,"percentile":0.31769}],"urls":["https://access.redhat.com/errata/RHSA-2026:66600","https://access.redhat.com/security/cve/CVE-2026-87875","https://bugzilla.redhat.com/show_bug.cgi?id=2530994","https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142","https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4","https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110921","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569286602"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110921","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569286602"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110921","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569286602"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110921","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569286602"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110921","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110921","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110921","date":"2026-10-17","epss":0.00223,"percentile":0.12016}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569286602"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110921","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110919","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568831769"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110920","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110920","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110920","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569659194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110919","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568831769"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110920","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110920","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110920","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569659194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110919","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568831769"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110920","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110920","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110920","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569659194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110919","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568831769"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110920","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110920","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110920","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569659194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110919","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110919","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110919","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568831769"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110919","description":"Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110920","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110920","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"risk":0.18174500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110920","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110920","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110920","date":"2026-10-17","epss":0.00223,"percentile":0.12015}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569659194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110920","description":"Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"968cab04caa47ab3","cpes":["cpe:2.3:a:gcc-14-base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14-base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14_base:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc-14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc_14:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-14-base:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_14_base:14.2.0-19:*:*:*:*:*:*:*"],"name":"gcc-14-base","purl":"pkg:deb/debian/gcc-14-base@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/gcc-14-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/gcc-14-base:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-17","epss":0.0025,"percentile":0.15179}],"risk":0.18125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-17","epss":0.0025,"percentile":0.15179}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"64d344f35c5fd422","cpes":["cpe:2.3:a:libatomic1:libatomic1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libatomic1","purl":"pkg:deb/debian/libatomic1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libatomic1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libatomic1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-17","epss":0.0025,"percentile":0.15179}],"risk":0.18125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-17","epss":0.0025,"percentile":0.15179}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"138a9da489396cfc","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:14.2.0-19:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:14.2.0-19:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/debian/libgcc-s1@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libgcc-s1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-17","epss":0.0025,"percentile":0.15179}],"risk":0.18125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-17","epss":0.0025,"percentile":0.15179}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"436375387486e8f6","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:14.2.0-19:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/debian/libstdc%2B%2B6@14.2.0-19?arch=arm64&distro=debian-13.7&upstream=gcc-14","type":"deb","version":"14.2.0-19","language":"","licenses":["sha256:20390f8a6f3b1e4d7cb45dd8652dabb259bbef688cbad839bcdb0b9ba7252f79"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-14-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libstdc++6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-14"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gcc-14","version":"14.2.0-19"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-17","epss":0.0025,"percentile":0.15179}],"risk":0.18125,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-17","epss":0.0025,"percentile":0.15179}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"f499f08d29476b59","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/debian/bsdutils@1%3A2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"5b04db34143fea42","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"4d86b378bd1ba8a0","cpes":["cpe:2.3:a:liblastlog2-2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2-2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"liblastlog2-2","purl":"pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblastlog2-2/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/liblastlog2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"07893143e3072ef0","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libmount1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"c850ed71cb1cd4a9","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"0362ef5f6b4ac926","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"2244af12d576a7c4","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:4.16.0-2+really2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"49363d0f62517793","cpes":["cpe:2.3:a:mount:mount:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"5e047e01cd6216a7","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"risk":0.1728,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-17","epss":0.00216,"percentile":0.11178}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24401","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24401","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-17","epss":0.00296,"percentile":0.20872}],"risk":0.17019999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."},"relatedVulnerabilities":[{"id":"CVE-2026-24401","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-17","epss":0.00296,"percentile":0.20872}],"urls":["https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524","https://github.com/avahi/avahi/issues/501","https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24401","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24401","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-17","epss":0.00296,"percentile":0.20872}],"risk":0.17019999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."},"relatedVulnerabilities":[{"id":"CVE-2026-24401","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-17","epss":0.00296,"percentile":0.20872}],"urls":["https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524","https://github.com/avahi/avahi/issues/501","https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-24401","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-24401","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-17","epss":0.00296,"percentile":0.20872}],"risk":0.17019999999999996,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."},"relatedVulnerabilities":[{"id":"CVE-2026-24401","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-24401","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-24401","date":"2026-10-17","epss":0.00296,"percentile":0.20872}],"urls":["https://github.com/avahi/avahi/commit/78eab31128479f06e30beb8c1cbf99dd921e2524","https://github.com/avahi/avahi/issues/501","https://github.com/avahi/avahi/security/advisories/GHSA-h4vp-5m8j-f6w3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24401","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and below, avahi-daemon can be crashed via a segmentation fault by sending an unsolicited mDNS response containing a recursive CNAME record, where the alias and canonical name point to the same domain (e.g., \"h.local\" as a CNAME for \"h.local\"). This causes unbounded recursion in the lookup_handle_cname function, leading to stack exhaustion. The vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST is set explicitly, which includes record browsers created by resolvers used by nss-mdns. This issue is patched in commit 78eab31128479f06e30beb8c1cbf99dd921e2524."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110144","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110144","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"risk":0.16663499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565252396"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110144","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110144","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"risk":0.16663499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565252396"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110144","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110144","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"risk":0.16663499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565252396"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110144","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110144","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"risk":0.16663499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565252396"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110144","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110144","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"risk":0.16663499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.6,"impactScore":6.1,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110144","cwe":"CWE-863","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110144","date":"2026-10-17","epss":0.00207,"percentile":0.10132}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/565252396"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110144","description":"Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)"}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-17","epss":0.03249,"percentile":0.88132}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-17","epss":0.03249,"percentile":0.88132}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-17","epss":0.03249,"percentile":0.88132}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-17","epss":0.03249,"percentile":0.88132}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-17","epss":0.03249,"percentile":0.88132}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-17","epss":0.03249,"percentile":0.88132}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-17","epss":0.03249,"percentile":0.88132}],"risk":0.16245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-10-17","epss":0.03249,"percentile":0.88132}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-17","epss":0.00315,"percentile":0.22857}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.  The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-17","epss":0.00315,"percentile":0.22857}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-17","epss":0.00315,"percentile":0.22857}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.  The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-17","epss":0.00315,"percentile":0.22857}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-17","epss":0.00315,"percentile":0.22857}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.  The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-17","epss":0.00315,"percentile":0.22857}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-17","epss":0.00315,"percentile":0.22857}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.  The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-17","epss":0.00315,"percentile":0.22857}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-17","epss":0.0322,"percentile":0.88025}],"risk":0.161,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-17","epss":0.0322,"percentile":0.88025}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-17","epss":0.0322,"percentile":0.88025}],"risk":0.161,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-17","epss":0.0322,"percentile":0.88025}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-17","epss":0.0322,"percentile":0.88025}],"risk":0.161,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-17","epss":0.0322,"percentile":0.88025}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-17","epss":0.0322,"percentile":0.88025}],"risk":0.161,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-10-17","epss":0.0322,"percentile":0.88025}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"7749346c7b926c46","cpes":["cpe:2.3:a:libllvm19:libllvm19:1\\:19.1.7-3\\+b1:*:*:*:*:*:*:*"],"name":"libllvm19","purl":"pkg:deb/debian/libllvm19@1%3A19.1.7-3%2Bb1?arch=arm64&distro=debian-13.7&upstream=llvm-toolchain-19%401%3A19.1.7-3","type":"deb","version":"1:19.1.7-3+b1","language":"","licenses":["APACHE-2-LLVM-EXCEPTIONS","Apache-2.0","BSD-3-Clause","BSD-3-clause","MIT","Python","solar-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libllvm19/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libllvm19/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libllvm19:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libllvm19:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"llvm-toolchain-19","version":"1:19.1.7-3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7883","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"llvm-toolchain-19","version":"1:19.1.7-3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-7883","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"arm-security@arm.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7883","cwe":"CWE-226","type":"Secondary","source":"arm-security@arm.com"}],"epss":[{"cve":"CVE-2024-7883","date":"2026-10-17","epss":0.00468,"percentile":0.39104}],"risk":0.15677999999999997,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-7883","description":"When using Arm Cortex-M Security Extensions (CMSE), Secure stack  contents can be leaked to Non-secure state via floating-point registers  when a Secure to Non-secure function call is made that returns a  floating-point value and when this is the first use of floating-point  since entering Secure state. This allows an attacker to read a limited  quantity of Secure stack contents with an impact on confidentiality.  This issue is specific to code generated using LLVM-based compilers."},"relatedVulnerabilities":[{"id":"CVE-2024-7883","cvss":[{"type":"Secondary","source":"arm-security@arm.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7883","cwe":"CWE-226","type":"Secondary","source":"arm-security@arm.com"}],"epss":[{"cve":"CVE-2024-7883","date":"2026-10-17","epss":0.00468,"percentile":0.39104}],"urls":["https://developer.arm.com/Arm%20Security%20Center/Cortex-M%20Security%20Extensions%20Vulnerability"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7883","description":"When using Arm Cortex-M Security Extensions (CMSE), Secure stack \ncontents can be leaked to Non-secure state via floating-point registers \nwhen a Secure to Non-secure function call is made that returns a \nfloating-point value and when this is the first use of floating-point \nsince entering Secure state. This allows an attacker to read a limited \nquantity of Secure stack contents with an impact on confidentiality. \nThis issue is specific to code generated using LLVM-based compilers."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9114","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2016-9114","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9114","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9114","date":"2026-10-17","epss":0.03077,"percentile":0.87464}],"risk":0.15385,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9114","description":"There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image->comps[compno].data is not assigned a value after initialization(NULL). Impact is Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2016-9114","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9114","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9114","date":"2026-10-17","epss":0.03077,"percentile":0.87464}],"urls":["http://www.securityfocus.com/bid/93979","https://github.com/uclouvain/openjpeg/issues/857","https://security.gentoo.org/glsa/201710-26"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9114","description":"There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image->comps[compno].data is not assigned a value after initialization(NULL). Impact is Denial of Service."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-17","epss":0.03069,"percentile":0.87433}],"risk":0.15345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-17","epss":0.03069,"percentile":0.87433}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-17","epss":0.03069,"percentile":0.87433}],"risk":0.15345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-17","epss":0.03069,"percentile":0.87433}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-17","epss":0.03069,"percentile":0.87433}],"risk":0.15345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-17","epss":0.03069,"percentile":0.87433}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-17","epss":0.03069,"percentile":0.87433}],"risk":0.15345,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-10-17","epss":0.03069,"percentile":0.87433}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9113","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2016-9113","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9113","date":"2026-10-17","epss":0.0305,"percentile":0.87355}],"risk":0.1525,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9113","description":"There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a value after initialization(NULL). Impact is Denial of Service."},"relatedVulnerabilities":[{"id":"CVE-2016-9113","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9113","date":"2026-10-17","epss":0.0305,"percentile":0.87355}],"urls":["http://www.securityfocus.com/bid/93980","https://github.com/uclouvain/openjpeg/issues/856","https://security.gentoo.org/glsa/201710-26"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9113","description":"There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a value after initialization(NULL). Impact is Denial of Service."}]},{"artifact":{"id":"6ac24feaec7856e0","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.8.12-1:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/debian/libx11-6@2%3A1.8.12-1?arch=arm64&distro=debian-13.7&upstream=libx11","type":"deb","version":"2:1.8.12-1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libx11-6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libx11","version":"2:1.8.12-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-88806","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-17","epss":0.00199,"percentile":0.0907}],"risk":0.14925,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88806","description":"A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map."},"relatedVulnerabilities":[{"id":"CVE-2026-88806","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-17","epss":0.00199,"percentile":0.0907}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88806","description":"A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map."}]},{"artifact":{"id":"25c33176f8e0362a","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.8.12-1:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/debian/libx11-data@2%3A1.8.12-1?arch=all&distro=debian-13.7&upstream=libx11","type":"deb","version":"2:1.8.12-1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libx11","version":"2:1.8.12-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-88806","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-17","epss":0.00199,"percentile":0.0907}],"risk":0.14925,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88806","description":"A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map."},"relatedVulnerabilities":[{"id":"CVE-2026-88806","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-17","epss":0.00199,"percentile":0.0907}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88806","description":"A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map."}]},{"artifact":{"id":"f08a55b681daa3af","cpes":["cpe:2.3:a:libx11-xcb1:libx11-xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-xcb1:libx11_xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11-xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11_xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*"],"name":"libx11-xcb1","purl":"pkg:deb/debian/libx11-xcb1@2%3A1.8.12-1?arch=arm64&distro=debian-13.7&upstream=libx11","type":"deb","version":"2:1.8.12-1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-xcb1/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libx11-xcb1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-xcb1:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libx11-xcb1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libx11","version":"2:1.8.12-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-88806","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-17","epss":0.00199,"percentile":0.0907}],"risk":0.14925,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-88806","description":"A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map."},"relatedVulnerabilities":[{"id":"CVE-2026-88806","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-17","epss":0.00199,"percentile":0.0907}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88806","description":"A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map."}]},{"artifact":{"id":"71485c50a427e265","cpes":["cpe:2.3:a:libjbig0:libjbig0:2.1-6.1\\+b2:*:*:*:*:*:*:*"],"name":"libjbig0","purl":"pkg:deb/debian/libjbig0@2.1-6.1%2Bb2?arch=arm64&distro=debian-13.7&upstream=jbigkit%402.1-6.1","type":"deb","version":"2.1-6.1+b2","language":"","licenses":["GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjbig0/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libjbig0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjbig0:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libjbig0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"jbigkit","version":"2.1-6.1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-9937","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"jbigkit","version":"2.1-6.1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2017-9937","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-9937","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9937","date":"2026-10-17","epss":0.02962,"percentile":0.86996}],"risk":0.1481,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9937","description":"In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack."},"relatedVulnerabilities":[{"id":"CVE-2017-9937","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9937","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9937","date":"2026-10-17","epss":0.02962,"percentile":0.86996}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2707","http://www.securityfocus.com/bid/99304","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9937","description":"In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-27447","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.3,"impactScore":4.3,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27447","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-27447","date":"2026-10-17","epss":0.0026,"percentile":0.1648}],"risk":0.14689999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-27447","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches."},"relatedVulnerabilities":[{"id":"CVE-2026-27447","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.3,"impactScore":4.3,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":4.3,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27447","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-27447","date":"2026-10-17","epss":0.0026,"percentile":0.1648}],"urls":["https://github.com/OpenPrinting/cups/commit/88516bf6d9e34cef7a64a704b856b837f70cd220","https://github.com/OpenPrinting/cups/security/advisories/GHSA-v987-m8hp-phj9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27447","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon (cupsd) contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an unprivileged user to gain unauthorized access to restricted operations by using a user with a username that differs only in case from an authorized user. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86143","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86143","cwe":"CWE-192","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86143","date":"2026-10-17","epss":0.00194,"percentile":0.08434}],"risk":0.14356,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86143","description":"In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback."},"relatedVulnerabilities":[{"id":"CVE-2026-86143","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.3,"impactScore":5.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86143","cwe":"CWE-192","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86143","date":"2026-10-17","epss":0.00194,"percentile":0.08434}],"urls":["https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86143","description":"In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback."}]},{"artifact":{"id":"f499f08d29476b59","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/debian/bsdutils@1%3A2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"5b04db34143fea42","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"4d86b378bd1ba8a0","cpes":["cpe:2.3:a:liblastlog2-2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2-2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"liblastlog2-2","purl":"pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblastlog2-2/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/liblastlog2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"07893143e3072ef0","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libmount1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"c850ed71cb1cd4a9","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"0362ef5f6b4ac926","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"2244af12d576a7c4","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:4.16.0-2+really2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"49363d0f62517793","cpes":["cpe:2.3:a:mount:mount:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"5e047e01cd6216a7","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"risk":0.14322000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-17","epss":0.00186,"percentile":0.07689}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86144","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86144","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86144","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86144","date":"2026-10-17","epss":0.00186,"percentile":0.07708}],"risk":0.14229000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86144","description":"In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow)."},"relatedVulnerabilities":[{"id":"CVE-2026-86144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86144","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86144","date":"2026-10-17","epss":0.00186,"percentile":0.07708}],"urls":["https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86144","description":"In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow)."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110146","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110146","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110146","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561039723"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110146","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110146","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110146","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561039723"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110146","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110146","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110146","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561039723"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110146","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110146","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110146","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561039723"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110146","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110146","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"risk":0.14202499999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110146","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110146","cwe":"CWE-200","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110146","date":"2026-10-17","epss":0.00247,"percentile":0.14915}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/561039723"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110146","description":"Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"25c630190e191390","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.2-1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/debian/libxi6@2%3A1.8.2-1?arch=arm64&distro=debian-13.7&upstream=libxi","type":"deb","version":"2:1.8.2-1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxi6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93542","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxi","version":"2:1.8.2-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93542","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93542","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93542","date":"2026-10-17","epss":0.00246,"percentile":0.14729}],"risk":0.14145,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93542","description":"An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client."},"relatedVulnerabilities":[{"id":"CVE-2026-93542","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93542","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93542","date":"2026-10-17","epss":0.00246,"percentile":0.14729}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=f499944ad595b9bd7e7571c810842244caf150aa"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93542","description":"An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client."}]},{"artifact":{"id":"25c630190e191390","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.2-1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/debian/libxi6@2%3A1.8.2-1?arch=arm64&distro=debian-13.7&upstream=libxi","type":"deb","version":"2:1.8.2-1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxi6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93541","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxi","version":"2:1.8.2-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93541","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93541","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93541","date":"2026-10-17","epss":0.00245,"percentile":0.14707}],"risk":0.14087499999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93541","description":"An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a"},"relatedVulnerabilities":[{"id":"CVE-2026-93541","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93541","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93541","date":"2026-10-17","epss":0.00245,"percentile":0.14707}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=7b6fffd13fd3914e0b39f3a4f131913da7f066e7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93541","description":"An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a"}]},{"artifact":{"id":"25c630190e191390","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.2-1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/debian/libxi6@2%3A1.8.2-1?arch=arm64&distro=debian-13.7&upstream=libxi","type":"deb","version":"2:1.8.2-1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxi6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93544","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxi","version":"2:1.8.2-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93544","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93544","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93544","date":"2026-10-17","epss":0.00245,"percentile":0.14707}],"risk":0.14087499999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93544","description":"An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client."},"relatedVulnerabilities":[{"id":"CVE-2026-93544","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93544","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93544","date":"2026-10-17","epss":0.00245,"percentile":0.14707}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=a88a341135b79f6ed450f481e4a5d6ba502382af"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93544","description":"An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client."}]},{"artifact":{"id":"893ab677af71bedc","cpes":["cpe:2.3:a:login.defs:login.defs:1\\:4.17.4-2:*:*:*:*:*:*:*"],"name":"login.defs","purl":"pkg:deb/debian/login.defs@1%3A4.17.4-2?arch=all&distro=debian-13.7&upstream=shadow","type":"deb","version":"1:4.17.4-2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login.defs/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/login.defs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.postinst"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"shadow","version":"1:4.17.4-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-17","epss":0.00426,"percentile":0.35461}],"risk":0.14057999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-17","epss":0.00426,"percentile":0.35461}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"83a4f25e33a63fb3","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.17.4-2:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/debian/passwd@1%3A4.17.4-2?arch=arm64&distro=debian-13.7&upstream=shadow","type":"deb","version":"1:4.17.4-2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"shadow","version":"1:4.17.4-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-17","epss":0.00426,"percentile":0.35461}],"risk":0.14057999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-17","epss":0.00426,"percentile":0.35461}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34990","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34990","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34990","date":"2026-10-17","epss":0.00182,"percentile":0.07307}],"risk":0.13923,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34990","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches."},"relatedVulnerabilities":[{"id":"CVE-2026-34990","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34990","cwe":"CWE-287","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34990","date":"2026-10-17","epss":0.00182,"percentile":0.07307}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-c54j-2vqw-wpwp"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34990","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a local unprivileged user can coerce cupsd into authenticating to an attacker-controlled localhost IPP service with a reusable Authorization: Local ... token. That token is enough to drive /admin/ requests on localhost, and the attacker can combine CUPS-Create-Local-Printer with printer-is-shared=true to persist a file:///... queue even though the normal FileDevice policy rejects such URIs. Printing to that queue gives an arbitrary root file overwrite; the PoC below uses that primitive to drop a sudoers fragment and demonstrate root command execution. At time of publication, there are no publicly available patches."}]},{"artifact":{"id":"fb1cc646c716a53f","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-6\\+deb13u1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.40.1-6%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=perl","type":"deb","version":"5.40.1-6+deb13u1","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"perl","version":"5.40.1-6+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-17","epss":0.00256,"percentile":0.16108}],"risk":0.13696,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.  The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.  A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-17","epss":0.00256,"percentile":0.16108}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"646b1521b54912a7","cpes":["cpe:2.3:a:libxtst6:libxtst6:2\\:1.2.5-1:*:*:*:*:*:*:*"],"name":"libxtst6","purl":"pkg:deb/debian/libxtst6@2%3A1.2.5-1?arch=arm64&distro=debian-13.7&upstream=libxtst","type":"deb","version":"2:1.2.5-1","language":"","licenses":["sha256:304f78731e1e0e78132fbba4e1909c8642878a3b8c4837b36cb2d38891bf2204"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxtst6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxtst6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxtst6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxtst6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxtst"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94286","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxtst","version":"2:1.2.5-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-94286","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94286","cwe":"CWE-126","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94286","date":"2026-10-17","epss":0.00185,"percentile":0.07514}],"risk":0.13505,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-94286","description":"An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients."},"relatedVulnerabilities":[{"id":"CVE-2026-94286","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94286","cwe":"CWE-126","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94286","date":"2026-10-17","epss":0.00185,"percentile":0.07514}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxtst/-/merge_requests/10/diffs?commit_id=16023c86070e6af9407330deea3938fcef75815b"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94286","description":"An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-16376","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-16376","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16376","date":"2026-10-17","epss":0.02647,"percentile":0.85371}],"risk":0.13235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16376","description":"An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact."},"relatedVulnerabilities":[{"id":"CVE-2018-16376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16376","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16376","date":"2026-10-17","epss":0.02647,"percentile":0.85371}],"urls":["http://www.securityfocus.com/bid/105262","https://github.com/uclouvain/openjpeg/issues/1127"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16376","description":"An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2010-4756","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-10-17","epss":0.02633,"percentile":0.85295}],"risk":0.13165,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."},"relatedVulnerabilities":[{"id":"CVE-2010-4756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-10-17","epss":0.02633,"percentile":0.85295}],"urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2010-4756","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-10-17","epss":0.02633,"percentile":0.85295}],"risk":0.13165,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."},"relatedVulnerabilities":[{"id":"CVE-2010-4756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-10-17","epss":0.02633,"percentile":0.85295}],"urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2010-4756","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-10-17","epss":0.02633,"percentile":0.85295}],"risk":0.13165,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."},"relatedVulnerabilities":[{"id":"CVE-2010-4756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-10-17","epss":0.02633,"percentile":0.85295}],"urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2010-4756","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-10-17","epss":0.02633,"percentile":0.85295}],"risk":0.13165,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."},"relatedVulnerabilities":[{"id":"CVE-2010-4756","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4756","date":"2026-10-17","epss":0.02633,"percentile":0.85295}],"urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2016-9117","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9117","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9117","date":"2026-10-17","epss":0.02558,"percentile":0.84831}],"risk":0.12789999999999999,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9117","description":"NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file."},"relatedVulnerabilities":[{"id":"CVE-2016-9117","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9117","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9117","date":"2026-10-17","epss":0.02558,"percentile":0.84831}],"urls":["http://www.securityfocus.com/bid/93783","https://github.com/uclouvain/openjpeg/issues/860","https://security.gentoo.org/glsa/201710-26"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9117","description":"NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-17","epss":0.0022,"percentile":0.11568}],"risk":0.1276,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-17","epss":0.0022,"percentile":0.11568}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-17","epss":0.0022,"percentile":0.11568}],"risk":0.1276,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-17","epss":0.0022,"percentile":0.11568}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-17","epss":0.0022,"percentile":0.11568}],"risk":0.1276,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-17","epss":0.0022,"percentile":0.11568}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-17","epss":0.0022,"percentile":0.11568}],"risk":0.1276,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-17","epss":0.0022,"percentile":0.11568}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39328","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2023-39328","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39328","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39328","date":"2026-10-17","epss":0.00242,"percentile":0.14354}],"risk":0.12705,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2023-39328","description":"A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file."},"relatedVulnerabilities":[{"id":"CVE-2023-39328","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39328","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39328","date":"2026-10-17","epss":0.00242,"percentile":0.14354}],"urls":["https://access.redhat.com/security/cve/CVE-2023-39328","https://bugzilla.redhat.com/show_bug.cgi?id=2219236","https://github.com/uclouvain/openjpeg/issues/1476","https://github.com/uclouvain/openjpeg/pull/1470","https://github.com/uclouvain/openjpeg/pull/1471"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39328","description":"A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86139","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86139","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86139","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86139","date":"2026-10-17","epss":0.00166,"percentile":0.05472}],"risk":0.12699,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86139","description":"In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow."},"relatedVulnerabilities":[{"id":"CVE-2026-86139","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86139","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86139","date":"2026-10-17","epss":0.00166,"percentile":0.05472}],"urls":["https://github.com/GNOME/libxml2/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86139","description":"In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010025","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-10-17","epss":0.02478,"percentile":0.84303}],"risk":0.12390000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-10-17","epss":0.02478,"percentile":0.84303}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010025","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-10-17","epss":0.02478,"percentile":0.84303}],"risk":0.12390000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-10-17","epss":0.02478,"percentile":0.84303}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010025","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-10-17","epss":0.02478,"percentile":0.84303}],"risk":0.12390000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-10-17","epss":0.02478,"percentile":0.84303}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-1010025","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-10-17","epss":0.02478,"percentile":0.84303}],"risk":0.12390000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010025","date":"2026-10-17","epss":0.02478,"percentile":0.84303}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-9192","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-10-17","epss":0.02447,"percentile":0.84094}],"risk":0.12235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"},"relatedVulnerabilities":[{"id":"CVE-2019-9192","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-10-17","epss":0.02447,"percentile":0.84094}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-9192","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-10-17","epss":0.02447,"percentile":0.84094}],"risk":0.12235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"},"relatedVulnerabilities":[{"id":"CVE-2019-9192","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-10-17","epss":0.02447,"percentile":0.84094}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-9192","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-10-17","epss":0.02447,"percentile":0.84094}],"risk":0.12235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"},"relatedVulnerabilities":[{"id":"CVE-2019-9192","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-10-17","epss":0.02447,"percentile":0.84094}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2019-9192","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-10-17","epss":0.02447,"percentile":0.84094}],"risk":0.12235,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"},"relatedVulnerabilities":[{"id":"CVE-2019-9192","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9192","date":"2026-10-17","epss":0.02447,"percentile":0.84094}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"}]},{"artifact":{"id":"d8fc8f8dd42428d3","cpes":["cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf-2.0-0","purl":"pkg:deb/debian/libgdk-pixbuf-2.0-0@2.42.12%2Bdfsg-4%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=gdk-pixbuf","type":"deb","version":"2.42.12+dfsg-4+deb13u1","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gdk-pixbuf","version":"2.42.12+dfsg-4+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-16768","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-10-17","epss":0.00237,"percentile":0.13634}],"risk":0.12205500000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."},"relatedVulnerabilities":[{"id":"CVE-2026-16768","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-10-17","epss":0.00237,"percentile":0.13634}],"urls":["https://access.redhat.com/security/cve/CVE-2026-16768","https://bugzilla.redhat.com/show_bug.cgi?id=2506437","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."}]},{"artifact":{"id":"920fc5b9189a88b5","cpes":["cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf2.0-common","purl":"pkg:deb/debian/libgdk-pixbuf2.0-common@2.42.12%2Bdfsg-4%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=gdk-pixbuf","type":"deb","version":"2.42.12+dfsg-4+deb13u1","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list"}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gdk-pixbuf","version":"2.42.12+dfsg-4+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-16768","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-10-17","epss":0.00237,"percentile":0.13634}],"risk":0.12205500000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."},"relatedVulnerabilities":[{"id":"CVE-2026-16768","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-10-17","epss":0.00237,"percentile":0.13634}],"urls":["https://access.redhat.com/security/cve/CVE-2026-16768","https://bugzilla.redhat.com/show_bug.cgi?id=2506437","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-58436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-58436","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58436","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-58436","date":"2026-10-17","epss":0.0023,"percentile":0.12891}],"risk":0.12075,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-58436","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15."},"relatedVulnerabilities":[{"id":"CVE-2025-58436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.1,"impactScore":3.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58436","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-58436","date":"2026-10-17","epss":0.0023,"percentile":0.12891}],"urls":["https://github.com/OpenPrinting/cups/commit/40008d76a001babbb9beb9d9d74b01a86fb6ddb4","https://github.com/OpenPrinting/cups/releases/tag/v2.4.15","https://github.com/OpenPrinting/cups/security/advisories/GHSA-8wpw-vfgm-qrrr","http://www.openwall.com/lists/oss-security/2025/11/27/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58436","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86140","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86140","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86140","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86140","date":"2026-10-17","epss":0.00157,"percentile":0.0444}],"risk":0.12010499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86140","description":"In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2026-86140","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86140","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86140","date":"2026-10-17","epss":0.00157,"percentile":0.0444}],"urls":["https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86140","description":"In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86142","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86142","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86142","cwe":"CWE-122","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86142","date":"2026-10-17","epss":0.00157,"percentile":0.04378}],"risk":0.12010499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86142","description":"In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation."},"relatedVulnerabilities":[{"id":"CVE-2026-86142","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86142","cwe":"CWE-122","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86142","date":"2026-10-17","epss":0.00157,"percentile":0.04378}],"urls":["https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86142","description":"In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-17","epss":0.00226,"percentile":0.12318}],"risk":0.11978,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.  The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-17","epss":0.00226,"percentile":0.12318}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-17","epss":0.00226,"percentile":0.12318}],"risk":0.11978,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.  The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-17","epss":0.00226,"percentile":0.12318}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-17","epss":0.00226,"percentile":0.12318}],"risk":0.11978,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.  The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-17","epss":0.00226,"percentile":0.12318}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-17","epss":0.00226,"percentile":0.12318}],"risk":0.11978,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.  The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-17","epss":0.00226,"percentile":0.12318}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"f499f08d29476b59","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/debian/bsdutils@1%3A2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"risk":0.11934,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"5b04db34143fea42","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"risk":0.11934,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"4d86b378bd1ba8a0","cpes":["cpe:2.3:a:liblastlog2-2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2-2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"liblastlog2-2","purl":"pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblastlog2-2/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/liblastlog2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"risk":0.11934,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"07893143e3072ef0","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libmount1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"risk":0.11934,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"c850ed71cb1cd4a9","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"risk":0.11934,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"0362ef5f6b4ac926","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"risk":0.11934,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"2244af12d576a7c4","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:4.16.0-2+really2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"risk":0.11934,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"49363d0f62517793","cpes":["cpe:2.3:a:mount:mount:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"risk":0.11934,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"5e047e01cd6216a7","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"risk":0.11934,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-17","epss":0.00156,"percentile":0.04289}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"25c630190e191390","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.2-1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/debian/libxi6@2%3A1.8.2-1?arch=arm64&distro=debian-13.7&upstream=libxi","type":"deb","version":"2:1.8.2-1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxi6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxi","version":"2:1.8.2-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-93545","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93545","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93545","date":"2026-10-17","epss":0.00199,"percentile":0.09072}],"risk":0.11442499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-93545","description":"An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."},"relatedVulnerabilities":[{"id":"CVE-2026-93545","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93545","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93545","date":"2026-10-17","epss":0.00199,"percentile":0.09072}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=234ce17d95c42d75f7f7fdb2bf7a24875451bc0a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93545","description":"An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}]},{"artifact":{"id":"6ac24feaec7856e0","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.8.12-1:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/debian/libx11-6@2%3A1.8.12-1?arch=arm64&distro=debian-13.7&upstream=libx11","type":"deb","version":"2:1.8.12-1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libx11-6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94283","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libx11","version":"2:1.8.12-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-94283","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-17","epss":0.00199,"percentile":0.09048}],"risk":0.11442499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-94283","description":"An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."},"relatedVulnerabilities":[{"id":"CVE-2026-94283","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-17","epss":0.00199,"percentile":0.09048}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94283","description":"An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"25c33176f8e0362a","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.8.12-1:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/debian/libx11-data@2%3A1.8.12-1?arch=all&distro=debian-13.7&upstream=libx11","type":"deb","version":"2:1.8.12-1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94283","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libx11","version":"2:1.8.12-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-94283","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-17","epss":0.00199,"percentile":0.09048}],"risk":0.11442499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-94283","description":"An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."},"relatedVulnerabilities":[{"id":"CVE-2026-94283","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-17","epss":0.00199,"percentile":0.09048}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94283","description":"An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"f08a55b681daa3af","cpes":["cpe:2.3:a:libx11-xcb1:libx11-xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-xcb1:libx11_xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11-xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11_xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_xcb1:2\\:1.8.12-1:*:*:*:*:*:*:*"],"name":"libx11-xcb1","purl":"pkg:deb/debian/libx11-xcb1@2%3A1.8.12-1?arch=arm64&distro=debian-13.7&upstream=libx11","type":"deb","version":"2:1.8.12-1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-xcb1/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libx11-xcb1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-xcb1:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libx11-xcb1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94283","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libx11","version":"2:1.8.12-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-94283","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-17","epss":0.00199,"percentile":0.09048}],"risk":0.11442499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-94283","description":"An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."},"relatedVulnerabilities":[{"id":"CVE-2026-94283","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-17","epss":0.00199,"percentile":0.09048}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94283","description":"An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"25c630190e191390","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.2-1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/debian/libxi6@2%3A1.8.2-1?arch=arm64&distro=debian-13.7&upstream=libxi","type":"deb","version":"2:1.8.2-1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxi6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94281","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxi","version":"2:1.8.2-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-94281","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94281","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94281","date":"2026-10-17","epss":0.00199,"percentile":0.09048}],"risk":0.11442499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-94281","description":"An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."},"relatedVulnerabilities":[{"id":"CVE-2026-94281","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94281","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94281","date":"2026-10-17","epss":0.00199,"percentile":0.09048}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=605f419d013153bf9e026cd100752ffbe930f3c1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94281","description":"An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}]},{"artifact":{"id":"6f1ff91197fa2435","cpes":["cpe:2.3:a:libp11-kit0:libp11-kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11-kit0:libp11_kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11-kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11_kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11-kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11_kit0:0.25.5-3:*:*:*:*:*:*:*"],"name":"libp11-kit0","purl":"pkg:deb/debian/libp11-kit0@0.25.5-3?arch=arm64&distro=debian-13.7&upstream=p11-kit","type":"deb","version":"0.25.5-3","language":"","licenses":["Apache-2.0","BSD-3-clause","FSFAP","FSFULLR","GPL-2+","GPL-3+","ISC","LGPL-2.1","LGPL-2.1+","X11","customFSFUL","customFSFULLRWD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libp11-kit0/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libp11-kit0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libp11-kit0:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libp11-kit0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"p11-kit"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"p11-kit","version":"0.25.5-3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-13757","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13757","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13757","date":"2026-10-17","epss":0.00202,"percentile":0.09448}],"risk":0.11312000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-13757","description":"A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services."},"relatedVulnerabilities":[{"id":"CVE-2026-13757","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13757","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13757","date":"2026-10-17","epss":0.00202,"percentile":0.09448}],"urls":["https://access.redhat.com/errata/RHSA-2026:37469","https://access.redhat.com/errata/RHSA-2026:38342","https://access.redhat.com/errata/RHSA-2026:49667","https://access.redhat.com/errata/RHSA-2026:49668","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:54387","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72394","https://access.redhat.com/errata/RHSA-2026:72395","https://access.redhat.com/errata/RHSA-2026:72399","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:81201","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82336","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-13757","https://bugzilla.redhat.com/show_bug.cgi?id=2494556","https://github.com/advisories/GHSA-p2wm-69qx-x25w"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13757","description":"A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9116","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2016-9116","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9116","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9116","date":"2026-10-17","epss":0.02236,"percentile":0.82513}],"risk":0.11180000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9116","description":"NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file."},"relatedVulnerabilities":[{"id":"CVE-2016-9116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9116","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9116","date":"2026-10-17","epss":0.02236,"percentile":0.82513}],"urls":["http://www.securityfocus.com/bid/93975","https://github.com/uclouvain/openjpeg/issues/859","https://security.gentoo.org/glsa/201710-26"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9116","description":"NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file."}]},{"artifact":{"id":"0c75a10f5c7b3ed8","cpes":["cpe:2.3:a:libacl1:libacl1:2.3.2-2\\+b1:*:*:*:*:*:*:*"],"name":"libacl1","purl":"pkg:deb/debian/libacl1@2.3.2-2%2Bb1?arch=arm64&distro=debian-13.7&upstream=acl%402.3.2-2","type":"deb","version":"2.3.2-2+b1","language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libacl1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"acl","version":"2.3.2-2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54369","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"acl","version":"2.3.2-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54369","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54369","date":"2026-10-17","epss":0.00153,"percentile":0.04027}],"risk":0.11168999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54369","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation."},"relatedVulnerabilities":[{"id":"CVE-2026-54369","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54369","date":"2026-10-17","epss":0.00153,"percentile":0.04027}],"urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions","https://access.redhat.com/errata/RHSA-2026:34351","https://access.redhat.com/errata/RHSA-2026:42736","https://access.redhat.com/errata/RHSA-2026:42739","https://access.redhat.com/errata/RHSA-2026:43420","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:54769","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:64805","https://access.redhat.com/errata/RHSA-2026:67140","https://access.redhat.com/errata/RHSA-2026:67142","https://access.redhat.com/errata/RHSA-2026:67144","https://access.redhat.com/security/cve/CVE-2026-54369","https://bugzilla.redhat.com/show_bug.cgi?id=2490277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54369","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation."}]},{"artifact":{"id":"f499f08d29476b59","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/debian/bsdutils@1%3A2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"risk":0.11164999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"5b04db34143fea42","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/debian/libblkid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libblkid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"risk":0.11164999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"4d86b378bd1ba8a0","cpes":["cpe:2.3:a:liblastlog2-2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2-2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2_2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2-2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:liblastlog2:liblastlog2_2:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"liblastlog2-2","purl":"pkg:deb/debian/liblastlog2-2@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/liblastlog2-2/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/liblastlog2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/liblastlog2-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"risk":0.11164999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"07893143e3072ef0","cpes":["cpe:2.3:a:libmount1:libmount1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/debian/libmount1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libmount1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"risk":0.11164999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"c850ed71cb1cd4a9","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/debian/libsmartcols1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libsmartcols1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"risk":0.11164999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"0362ef5f6b4ac926","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/debian/libuuid1@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libuuid1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"risk":0.11164999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"2244af12d576a7c4","cpes":["cpe:2.3:a:login:login:1\\:4.16.0-2\\+really2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/debian/login@1%3A4.16.0-2%2Breally2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux%402.41.5-0%2Bdeb13u1","type":"deb","version":"1:4.16.0-2+really2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.defs.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.conffiles"},{"path":"/var/lib/dpkg/info/login.defs.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.list"},{"path":"/var/lib/dpkg/info/login.defs.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.md5sums"},{"path":"/var/lib/dpkg/info/login.defs.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.defs.postinst"},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"util-linux","version":"2.41.5-0+deb13u1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"risk":0.11164999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"49363d0f62517793","cpes":["cpe:2.3:a:mount:mount:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/debian/mount@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=util-linux","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"risk":0.11164999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"5e047e01cd6216a7","cpes":["cpe:2.3:a:util-linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.41.5-0\\+deb13u1:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/debian/util-linux@2.41.5-0%2Bdeb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"2.41.5-0+deb13u1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-4-clause","BSLA","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"util-linux","version":"2.41.5-0+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"risk":0.11164999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-17","epss":0.00154,"percentile":0.04108}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-17","epss":0.0024,"percentile":0.14047}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a  stack overflow when a malicious DNS server returns too large a response  for a DNS query, resulting in degraded DNS resolution for the system.    Exploitation of this bug needs a system that has nscd enabled and using  an untrusted DNS server for name resolution, with the compromised DNS  server being capable of processing records large enough to result in a  stack overflow in an nscd thread stack.  During experimentation, bind 9  was unable to handle large records, but that could change in future or  with a different name server.  In typical installations, nscd is  executed in an isolated context as its own user without a shell, due to  which any compromise of that service is isolated.    There is a remote possibility of nscd cache corruption if an attacker  manages to get the stack pointer into a desired point in the heap,  potentially resulting in other caches in nscd being overwritten with  corrupt data through the stack overflow, until the buggy code path  eventually results in a crash.    Finally, a crash in nscd may result in performance degradation when  resolving names, but it does not result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-17","epss":0.0024,"percentile":0.14047}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-17","epss":0.0024,"percentile":0.14047}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a  stack overflow when a malicious DNS server returns too large a response  for a DNS query, resulting in degraded DNS resolution for the system.    Exploitation of this bug needs a system that has nscd enabled and using  an untrusted DNS server for name resolution, with the compromised DNS  server being capable of processing records large enough to result in a  stack overflow in an nscd thread stack.  During experimentation, bind 9  was unable to handle large records, but that could change in future or  with a different name server.  In typical installations, nscd is  executed in an isolated context as its own user without a shell, due to  which any compromise of that service is isolated.    There is a remote possibility of nscd cache corruption if an attacker  manages to get the stack pointer into a desired point in the heap,  potentially resulting in other caches in nscd being overwritten with  corrupt data through the stack overflow, until the buggy code path  eventually results in a crash.    Finally, a crash in nscd may result in performance degradation when  resolving names, but it does not result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-17","epss":0.0024,"percentile":0.14047}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-17","epss":0.0024,"percentile":0.14047}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a  stack overflow when a malicious DNS server returns too large a response  for a DNS query, resulting in degraded DNS resolution for the system.    Exploitation of this bug needs a system that has nscd enabled and using  an untrusted DNS server for name resolution, with the compromised DNS  server being capable of processing records large enough to result in a  stack overflow in an nscd thread stack.  During experimentation, bind 9  was unable to handle large records, but that could change in future or  with a different name server.  In typical installations, nscd is  executed in an isolated context as its own user without a shell, due to  which any compromise of that service is isolated.    There is a remote possibility of nscd cache corruption if an attacker  manages to get the stack pointer into a desired point in the heap,  potentially resulting in other caches in nscd being overwritten with  corrupt data through the stack overflow, until the buggy code path  eventually results in a crash.    Finally, a crash in nscd may result in performance degradation when  resolving names, but it does not result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-17","epss":0.0024,"percentile":0.14047}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-17","epss":0.0024,"percentile":0.14047}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a  stack overflow when a malicious DNS server returns too large a response  for a DNS query, resulting in degraded DNS resolution for the system.    Exploitation of this bug needs a system that has nscd enabled and using  an untrusted DNS server for name resolution, with the compromised DNS  server being capable of processing records large enough to result in a  stack overflow in an nscd thread stack.  During experimentation, bind 9  was unable to handle large records, but that could change in future or  with a different name server.  In typical installations, nscd is  executed in an isolated context as its own user without a shell, due to  which any compromise of that service is isolated.    There is a remote possibility of nscd cache corruption if an attacker  manages to get the stack pointer into a desired point in the heap,  potentially resulting in other caches in nscd being overwritten with  corrupt data through the stack overflow, until the buggy code path  eventually results in a crash.    Finally, a crash in nscd may result in performance degradation when  resolving names, but it does not result in a denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-17","epss":0.0024,"percentile":0.14047}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"e13136159fee6ca0","cpes":["cpe:2.3:a:libminizip1t64:libminizip1t64:1\\:1.3.dfsg\\+really1.3.1-1\\+b1:*:*:*:*:*:*:*"],"name":"libminizip1t64","purl":"pkg:deb/debian/libminizip1t64@1%3A1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=zlib%401%3A1.3.dfsg%2Breally1.3.1-1","type":"deb","version":"1:1.3.dfsg+really1.3.1-1+b1","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libminizip1t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libminizip1t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libminizip1t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libminizip1t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-27171","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-17","epss":0.00209,"percentile":0.10407}],"risk":0.10972499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-27171","description":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."},"relatedVulnerabilities":[{"id":"CVE-2026-27171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-17","epss":0.00209,"percentile":0.10407}],"urls":["https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/","https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf","https://github.com/madler/zlib/issues/904","https://github.com/madler/zlib/releases/tag/v1.3.2","https://ostif.org/zlib-audit-complete/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27171","description":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."}]},{"artifact":{"id":"a314be46474190d8","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg\\+really1.3.1-1\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.3.dfsg%2Breally1.3.1-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=zlib%401%3A1.3.dfsg%2Breally1.3.1-1","type":"deb","version":"1:1.3.dfsg+really1.3.1-1+b1","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/zlib1g:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-27171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"zlib","version":"1:1.3.dfsg+really1.3.1-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-27171","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-17","epss":0.00209,"percentile":0.10407}],"risk":0.10972499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-27171","description":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."},"relatedVulnerabilities":[{"id":"CVE-2026-27171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-17","epss":0.00209,"percentile":0.10407}],"urls":["https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/","https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf","https://github.com/madler/zlib/issues/904","https://github.com/madler/zlib/releases/tag/v1.3.2","https://ostif.org/zlib-audit-complete/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27171","description":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86137","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86137","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86137","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86137","date":"2026-10-17","epss":0.00195,"percentile":0.08573}],"risk":0.10822499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86137","description":"In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp."},"relatedVulnerabilities":[{"id":"CVE-2026-86137","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86137","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86137","date":"2026-10-17","epss":0.00195,"percentile":0.08573}],"urls":["https://github.com/GNOME/libxml2/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4","https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1099"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86137","description":"In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10505","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2016-10505","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-10505","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10505","date":"2026-10-17","epss":0.02149,"percentile":0.81813}],"risk":0.10744999999999999,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10505","description":"NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files."},"relatedVulnerabilities":[{"id":"CVE-2016-10505","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10505","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10505","date":"2026-10-17","epss":0.02149,"percentile":0.81813}],"urls":["https://github.com/uclouvain/openjpeg/issues/776","https://github.com/uclouvain/openjpeg/issues/784","https://github.com/uclouvain/openjpeg/issues/785","https://github.com/uclouvain/openjpeg/issues/792","https://security.gentoo.org/glsa/201710-26"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10505","description":"NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files."}]},{"artifact":{"id":"1e539cf5aec9013f","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66382","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-66382","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-10-17","epss":0.00203,"percentile":0.09554}],"risk":0.106575,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-66382","description":"In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time."},"relatedVulnerabilities":[{"id":"CVE-2025-66382","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-10-17","epss":0.00203,"percentile":0.09554}],"urls":["https://github.com/libexpat/libexpat/issues/1076","http://www.openwall.com/lists/oss-security/2025/12/02/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66382","description":"In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9115","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2016-9115","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9115","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9115","date":"2026-10-17","epss":0.02118,"percentile":0.81542}],"risk":0.10590000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9115","description":"Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file."},"relatedVulnerabilities":[{"id":"CVE-2016-9115","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9115","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9115","date":"2026-10-17","epss":0.02118,"percentile":0.81542}],"urls":["http://www.securityfocus.com/bid/93977","https://github.com/uclouvain/openjpeg/issues/858","https://security.gentoo.org/glsa/201710-26"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9115","description":"Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file."}]},{"artifact":{"id":"7b56faa19a5bf770","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-10-17","epss":0.02049,"percentile":0.80903}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-10-17","epss":0.02049,"percentile":0.80903}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"e686653c2eec5351","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libk5crypto3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-10-17","epss":0.02049,"percentile":0.80903}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-10-17","epss":0.02049,"percentile":0.80903}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"5704086a7f71bde2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libkrb5-3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-10-17","epss":0.02049,"percentile":0.80903}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-10-17","epss":0.02049,"percentile":0.80903}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"30ccf2cb893c6151","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.21.3-5\\+deb13u1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.21.3-5%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=krb5","type":"deb","version":"1.21.3-5+deb13u1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libkrb5support0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"krb5","version":"1.21.3-5+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-5709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-10-17","epss":0.02049,"percentile":0.80903}],"risk":0.10245,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."},"relatedVulnerabilities":[{"id":"CVE-2018-5709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5709","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5709","date":"2026-10-17","epss":0.02049,"percentile":0.80903}],"urls":["https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5709","description":"An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable \"dbentry->n_key_data\" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a \"u4\" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data."}]},{"artifact":{"id":"0afd960a047202b3","cpes":["cpe:2.3:a:libglib2.0-0t64:libglib2.0-0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-0t64:libglib2.0_0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0t64:libglib2.0-0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0t64:libglib2.0_0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*"],"name":"libglib2.0-0t64","purl":"pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u5?arch=arm64&distro=debian-13.7&upstream=glib2.0","type":"deb","version":"2.84.4-3~deb13u5","language":"","licenses":["AFL-2.0","Apache-2.0","CC-BY-SA-3.0","CC0-1.0","Expat","FSFULLR","GPL-2","GPL-2+","Iconv-PD","Janik-permissive","Kuchling-PD","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MPL-1.1","Mingw-PD","Plumb-PD","Unicode-DFS-2016","bzip2-1.0.6","cmph","old-glib-tests"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-0t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libglib2.0-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-0t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libglib2.0-0t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glib2.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2012-0039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glib2.0","version":"2.84.4-3~deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2012-0039","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-0039","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-0039","date":"2026-10-17","epss":0.02043,"percentile":0.80839}],"risk":0.10215,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2012-0039","description":"GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application."},"relatedVulnerabilities":[{"id":"CVE-2012-0039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-0039","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-0039","date":"2026-10-17","epss":0.02043,"percentile":0.80839}],"urls":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655044","http://mail.gnome.org/archives/gtk-devel-list/2003-May/msg00111.html","http://openwall.com/lists/oss-security/2012/01/10/12","https://bugzilla.redhat.com/show_bug.cgi?id=772720"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-0039","description":"GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-39316","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39316","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39316","date":"2026-10-17","epss":0.00182,"percentile":0.07274}],"risk":0.10192000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-39316","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution."},"relatedVulnerabilities":[{"id":"CVE-2026-39316","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39316","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39316","date":"2026-10-17","epss":0.00182,"percentile":0.07274}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pjv5-prqp-46rg"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39316","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, a use-after-free vulnerability exists in the CUPS scheduler (cupsd) when temporary printers are automatically deleted. cupsdDeleteTemporaryPrinters() in scheduler/printers.c calls cupsdDeletePrinter() without first expiring subscriptions that reference the printer, leaving cupsd_subscription_t.dest as a dangling pointer to freed heap memory. The dangling pointer is subsequently dereferenced at multiple code sites, causing a crash (denial of service) of the cupsd daemon. With heap grooming, this can be leveraged for code execution."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86138","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86138","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86138","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86138","date":"2026-10-17","epss":0.00132,"percentile":0.02467}],"risk":0.10097999999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86138","description":"In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2026-86138","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.9,"impactScore":5.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86138","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86138","date":"2026-10-17","epss":0.00132,"percentile":0.02467}],"urls":["https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4","https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86138","description":"In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9580","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2016-9580","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9580","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9580","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9580","cwe":"CWE-190","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9580","date":"2026-10-17","epss":0.01994,"percentile":0.80364}],"risk":0.09970000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9580","description":"An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow."},"relatedVulnerabilities":[{"id":"CVE-2016-9580","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9580","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9580","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9580","cwe":"CWE-190","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9580","date":"2026-10-17","epss":0.01994,"percentile":0.80364}],"urls":["http://www.securityfocus.com/bid/94822","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9580","https://github.com/szukw000/openjpeg/commit/cadff5fb6e73398de26a92e96d3d7cac893af255","https://github.com/uclouvain/openjpeg/issues/871","https://security.gentoo.org/glsa/201710-26"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9580","description":"An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-87876","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3,"impactScore":1.5,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-10-17","epss":0.00328,"percentile":0.24316}],"risk":0.09839999999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-87876","description":"Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations."},"relatedVulnerabilities":[{"id":"CVE-2026-87876","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3,"impactScore":1.5,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-10-17","epss":0.00328,"percentile":0.24316}],"urls":["https://access.redhat.com/errata/RHSA-2026:67568","https://access.redhat.com/security/cve/CVE-2026-87876","https://bugzilla.redhat.com/show_bug.cgi?id=2530991","https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8","https://github.com/OpenPrinting/cups/commit/f56844dbe4a54a9f8e1aeb3b913fbee614156bdb","https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87876","description":"Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-17","epss":0.00292,"percentile":0.20334}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.  This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-17","epss":0.00292,"percentile":0.20334}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"5886e793c6b08095","cpes":["cpe:2.3:a:libc-l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_l10n:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_l10n:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-l10n","purl":"pkg:deb/debian/libc-l10n@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-l10n/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libc-l10n/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-l10n.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libc-l10n.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-17","epss":0.00292,"percentile":0.20334}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.  This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-17","epss":0.00292,"percentile":0.20334}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"3747e05e89038717","cpes":["cpe:2.3:a:libc6:libc6:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-17","epss":0.00292,"percentile":0.20334}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.  This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-17","epss":0.00292,"percentile":0.20334}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"e9141be499a1730f","cpes":["cpe:2.3:a:locales:locales:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/debian/locales@2.41-12%2Bdeb13u4?arch=all&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-17","epss":0.00292,"percentile":0.20334}],"risk":0.09781999999999998,"urls":[],"severity":"Low","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.  This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-17","epss":0.00292,"percentile":0.20334}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"5ddebfa272654690","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.3-2.1\\~deb13u2:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/debian/libopenjp2-7@2.5.3-2.1~deb13u2?arch=arm64&distro=debian-13.7&upstream=openjpeg2","type":"deb","version":"2.5.3-2.1~deb13u2","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libopenjp2-7:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9581","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"openjpeg2","version":"2.5.3-2.1~deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2016-9581","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-9581","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9581","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9581","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9581","date":"2026-10-17","epss":0.01944,"percentile":0.79824}],"risk":0.0972,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9581","description":"An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2."},"relatedVulnerabilities":[{"id":"CVE-2016-9581","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9581","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9581","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-9581","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9581","date":"2026-10-17","epss":0.01944,"percentile":0.79824}],"urls":["http://www.securityfocus.com/bid/94822","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9581","https://github.com/szukw000/openjpeg/commit/cadff5fb6e73398de26a92e96d3d7cac893af255","https://github.com/uclouvain/openjpeg/issues/872","https://security.gentoo.org/glsa/201710-26"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9581","description":"An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2."}]},{"artifact":{"id":"32e2516577af1ce8","cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"libncursesw6","purl":"pkg:deb/debian/libncursesw6@6.5%2B20250216-2?arch=arm64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libncursesw6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-6141","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6141","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-6141","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-6141","date":"2026-10-17","epss":0.00196,"percentile":0.08715}],"risk":0.09603999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-6141","description":"A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."},"relatedVulnerabilities":[{"id":"CVE-2025-6141","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6141","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-6141","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-6141","date":"2026-10-17","epss":0.00196,"percentile":0.08715}],"urls":["https://invisible-island.net/ncurses/NEWS.html#index-t20250329","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html","https://vuldb.com/?ctiid.312610","https://vuldb.com/?id.312610","https://vuldb.com/?submit.593000","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6141","description":"A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"109ce5d685f813c6","cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"libtinfo6","purl":"pkg:deb/debian/libtinfo6@6.5%2B20250216-2?arch=arm64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libtinfo6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-6141","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6141","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-6141","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-6141","date":"2026-10-17","epss":0.00196,"percentile":0.08715}],"risk":0.09603999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-6141","description":"A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."},"relatedVulnerabilities":[{"id":"CVE-2025-6141","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6141","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-6141","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-6141","date":"2026-10-17","epss":0.00196,"percentile":0.08715}],"urls":["https://invisible-island.net/ncurses/NEWS.html#index-t20250329","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html","https://vuldb.com/?ctiid.312610","https://vuldb.com/?id.312610","https://vuldb.com/?submit.593000","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6141","description":"A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"3f9378db54aaac9e","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@6.5%2B20250216-2?arch=all&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-6141","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6141","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-6141","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-6141","date":"2026-10-17","epss":0.00196,"percentile":0.08715}],"risk":0.09603999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-6141","description":"A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."},"relatedVulnerabilities":[{"id":"CVE-2025-6141","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6141","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-6141","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-6141","date":"2026-10-17","epss":0.00196,"percentile":0.08715}],"urls":["https://invisible-island.net/ncurses/NEWS.html#index-t20250329","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html","https://vuldb.com/?ctiid.312610","https://vuldb.com/?id.312610","https://vuldb.com/?submit.593000","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6141","description":"A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"a6728d83d34dc83a","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.5\\+20250216-2:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.5\\+20250216-2:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@6.5%2B20250216-2?arch=arm64&distro=debian-13.7&upstream=ncurses","type":"deb","version":"6.5+20250216-2","language":"","licenses":["BSD-3-clause","MIT/X11","X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6141","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"ncurses","version":"6.5+20250216-2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-6141","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6141","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-6141","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-6141","date":"2026-10-17","epss":0.00196,"percentile":0.08715}],"risk":0.09603999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-6141","description":"A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."},"relatedVulnerabilities":[{"id":"CVE-2025-6141","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6141","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-6141","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-6141","date":"2026-10-17","epss":0.00196,"percentile":0.08715}],"urls":["https://invisible-island.net/ncurses/NEWS.html#index-t20250329","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html","https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html","https://vuldb.com/?ctiid.312610","https://vuldb.com/?id.312610","https://vuldb.com/?submit.593000","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6141","description":"A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59529","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-59529","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59529","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-59529","date":"2026-10-17","epss":0.00179,"percentile":0.06956}],"risk":0.093975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-59529","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users."},"relatedVulnerabilities":[{"id":"CVE-2025-59529","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59529","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-59529","date":"2026-10-17","epss":0.00179,"percentile":0.06956}],"urls":["https://github.com/avahi/avahi/pull/808","https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q","https://zeropath.com/blog/avahi-simple-protocol-server-dos-cve-2025-59529","http://www.openwall.com/lists/oss-security/2025/12/19/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59529","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59529","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-59529","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59529","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-59529","date":"2026-10-17","epss":0.00179,"percentile":0.06956}],"risk":0.093975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-59529","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users."},"relatedVulnerabilities":[{"id":"CVE-2025-59529","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59529","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-59529","date":"2026-10-17","epss":0.00179,"percentile":0.06956}],"urls":["https://github.com/avahi/avahi/pull/808","https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q","https://zeropath.com/blog/avahi-simple-protocol-server-dos-cve-2025-59529","http://www.openwall.com/lists/oss-security/2025/12/19/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59529","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-59529","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-59529","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59529","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-59529","date":"2026-10-17","epss":0.00179,"percentile":0.06956}],"risk":0.093975,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-59529","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users."},"relatedVulnerabilities":[{"id":"CVE-2025-59529","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-59529","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-59529","date":"2026-10-17","epss":0.00179,"percentile":0.06956}],"urls":["https://github.com/avahi/avahi/pull/808","https://github.com/avahi/avahi/security/advisories/GHSA-73wf-3xmj-x82q","https://zeropath.com/blog/avahi-simple-protocol-server-dos-cve-2025-59529","http://www.openwall.com/lists/oss-security/2025/12/19/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59529","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simple protocol server ignores the documented client limit and accepts unlimited connections, allowing for easy local DoS. Although `CLIENTS_MAX` is defined, `server_work()` unconditionally `accept()`s and `client_new()` always appends the new client and increments `n_clients`. There is no check against the limit. When client cannot be accepted as a result of maximal socket number of avahi-daemon, it logs unconditionally error per each connection. Unprivileged local users can exhaust daemon memory and file descriptors, causing a denial of service system-wide for mDNS/DNS-SD. Exhausting local file descriptors causes increased system load caused by logging errors of each of request. Overloading prevents glibc calls using nss-mdns plugins to resolve `*.local.` names and link-local addresses. As of time of publication, no known patched versions are available, but a candidate fix is available in pull request 808, and some workarounds are available. Simple clients are offered for nss-mdns package functionality. It is not possible to disable the unix socket `/run/avahi-daemon/socket`, but resolution requests received via DBus are not affected directly. Tools avahi-resolve, avahi-resolve-address and avahi-resolve-host-name are not affected, they use DBus interface. It is possible to change permissions of unix socket after avahi-daemon is started. But avahi-daemon does not provide any configuration for it. Additional access restrictions like SELinux can also prevent unwanted tools to access the socket and keep resolution working for trusted users."}]},{"artifact":{"id":"d8fc8f8dd42428d3","cpes":["cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf-2.0-0","purl":"pkg:deb/debian/libgdk-pixbuf-2.0-0@2.42.12%2Bdfsg-4%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=gdk-pixbuf","type":"deb","version":"2.42.12+dfsg-4+deb13u1","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18090","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gdk-pixbuf","version":"2.42.12+dfsg-4+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-18090","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18090","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18090","date":"2026-10-17","epss":0.00167,"percentile":0.05568}],"risk":0.09268499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-18090","description":"A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory."},"relatedVulnerabilities":[{"id":"CVE-2026-18090","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18090","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18090","date":"2026-10-17","epss":0.00167,"percentile":0.05568}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18090","https://bugzilla.redhat.com/show_bug.cgi?id=2517751","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/308"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18090","description":"A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory."}]},{"artifact":{"id":"920fc5b9189a88b5","cpes":["cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf2.0-common","purl":"pkg:deb/debian/libgdk-pixbuf2.0-common@2.42.12%2Bdfsg-4%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=gdk-pixbuf","type":"deb","version":"2.42.12+dfsg-4+deb13u1","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list"}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18090","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gdk-pixbuf","version":"2.42.12+dfsg-4+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-18090","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18090","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18090","date":"2026-10-17","epss":0.00167,"percentile":0.05568}],"risk":0.09268499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-18090","description":"A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory."},"relatedVulnerabilities":[{"id":"CVE-2026-18090","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18090","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18090","date":"2026-10-17","epss":0.00167,"percentile":0.05568}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18090","https://bugzilla.redhat.com/show_bug.cgi?id=2517751","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/308"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18090","description":"A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory."}]},{"artifact":{"id":"56182221a173d843","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.7.0-3\\+deb13u3:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=arm64&distro=debian-13.7&upstream=tiff","type":"deb","version":"4.7.0-3+deb13u3","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-1210","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tiff","version":"4.7.0-3+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2022-1210","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-1210","cwe":"CWE-400","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2022-1210","cwe":"CWE-404","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1210","date":"2026-10-17","epss":0.01851,"percentile":0.78775}],"risk":0.09255,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-1210","description":"A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used."},"relatedVulnerabilities":[{"id":"CVE-2022-1210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1210","cwe":"CWE-400","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2022-1210","cwe":"CWE-404","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1210","date":"2026-10-17","epss":0.01851,"percentile":0.78775}],"urls":["https://gitlab.com/libtiff/libtiff/-/issues/402","https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff","https://security.gentoo.org/glsa/202210-10","https://security.netapp.com/advisory/ntap-20220513-0005/","https://vuldb.com/?id.196363"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1210","description":"A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"56182221a173d843","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.7.0-3\\+deb13u3:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/debian/libtiff6@4.7.0-3%2Bdeb13u3?arch=arm64&distro=debian-13.7&upstream=tiff","type":"deb","version":"4.7.0-3+deb13u3","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libtiff6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"tiff","version":"4.7.0-3+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-10126","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-17","epss":0.01829,"percentile":0.785}],"risk":0.09145,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."},"relatedVulnerabilities":[{"id":"CVE-2018-10126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-17","epss":0.01829,"percentile":0.785}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2786","https://gitlab.com/libtiff/libtiff/-/issues/128","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."}]},{"artifact":{"id":"f5ede53a8dee69b3","cpes":["cpe:2.3:a:libfreetype6:libfreetype6:2.13.3\\+dfsg-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libfreetype6","purl":"pkg:deb/debian/libfreetype6@2.13.3%2Bdfsg-1%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=freetype","type":"deb","version":"2.13.3+dfsg-1+deb13u1","language":"","licenses":["BSD-3-Clause","BSL-1.0","Expat","FSFAP","FTL","GPL-2","GPL-2+","GPL-3","GPL-3+","MIT-Modern-Variant","MIT-SMC","OpenGroup-MIT","Public-Domain","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libfreetype6/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libfreetype6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libfreetype6:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libfreetype6:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"freetype"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95512","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"freetype","version":"2.13.3+dfsg-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-95512","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95512","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95512","date":"2026-10-17","epss":0.00174,"percentile":0.06415}],"risk":0.09135,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-95512","description":"A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate."},"relatedVulnerabilities":[{"id":"CVE-2026-95512","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95512","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95512","date":"2026-10-17","epss":0.00174,"percentile":0.06415}],"urls":["https://access.redhat.com/errata/RHSA-2026:74952","https://access.redhat.com/security/cve/CVE-2026-95512","https://bugzilla.redhat.com/show_bug.cgi?id=2462295","https://gitlab.freedesktop.org/freetype/freetype/-/commit/f3ca71c9900fe860849b3163a6e2c1e765b291d9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95512","description":"A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate."}]},{"artifact":{"id":"e45e65d8365185c1","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.8-6:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.8-6:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.8-6:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.8-6:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.8-6:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.8-6:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/debian/libbz2-1.0@1.0.8-6?arch=arm64&distro=debian-13.7&upstream=bzip2","type":"deb","version":"1.0.8-6","language":"","licenses":["BSD-variant","GPL-2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libbz2-1.0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42250","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"bzip2","version":"1.0.8-6"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-42250","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-10-17","epss":0.00182,"percentile":0.07306}],"risk":0.08918,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).  This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"},"relatedVulnerabilities":[{"id":"CVE-2026-42250","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42250","cwe":"CWE-787","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-42250","date":"2026-10-17","epss":0.00182,"percentile":0.07306}],"urls":["https://cert.pl/en/posts/2026/05/CVE-2026-42250/","https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/","https://sourceware.org/bzip2/","https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-39314","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39314","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39314","date":"2026-10-17","epss":0.00158,"percentile":0.04492}],"risk":0.08848000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-39314","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service."},"relatedVulnerabilities":[{"id":"CVE-2026-39314","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39314","cwe":"CWE-191","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39314","date":"2026-10-17","epss":0.00158,"percentile":0.04492}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pp8w-2g52-7vj7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39314","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, an integer underflow vulnerability in _ppdCreateFromIPP() (cups/ppd-cache.c) allows any unprivileged local user to crash the cupsd root process by supplying a negative job-password-supported IPP attribute. The bounds check only caps the upper bound, so a negative value passes validation, is cast to size_t (wrapping to ~2^64), and is used as the length argument to memset() on a 33-byte stack buffer. This causes an immediate SIGSEGV in the cupsd root process. Combined with systemd's Restart=on-failure, an attacker can repeat the crash for sustained denial of service."}]},{"artifact":{"id":"25e48be699bee41c","cpes":["cpe:2.3:a:libxml2:libxml2:2.12.7\\+dfsg\\+really2.9.14-2.1\\+deb13u3:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.12.7%2Bdfsg%2Breally2.9.14-2.1%2Bdeb13u3?arch=arm64&distro=debian-13.7","type":"deb","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libxml2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"libxml2","version":"2.12.7+dfsg+really2.9.14-2.1+deb13u3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76781","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76781","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-76781","date":"2026-10-17","epss":0.00167,"percentile":0.05553}],"risk":0.087675,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76781","description":"A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS)."},"relatedVulnerabilities":[{"id":"CVE-2026-76781","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76781","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-76781","date":"2026-10-17","epss":0.00167,"percentile":0.05553}],"urls":["https://access.redhat.com/errata/RHSA-2026:57604","https://access.redhat.com/security/cve/CVE-2026-76781","https://bugzilla.redhat.com/show_bug.cgi?id=2519776","https://gitlab.gnome.org/GNOME/libxml2/-/commit/c6324894","https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/442"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76781","description":"A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS)."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110143","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110143","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"risk":0.08649000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/554531101"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110143","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110143","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"risk":0.08649000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/554531101"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110143","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110143","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"risk":0.08649000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/554531101"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110143","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110143","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"risk":0.08649000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/554531101"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110143","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110143","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"risk":0.08649000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110143","cwe":"CWE-457","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110143","date":"2026-10-17","epss":0.00186,"percentile":0.07648}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/554531101"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110143","description":"Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read memory inside the sandbox via a crafted file. (Chromium security severity: High)"}]},{"artifact":{"id":"6f1ff91197fa2435","cpes":["cpe:2.3:a:libp11-kit0:libp11-kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11-kit0:libp11_kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11-kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11_kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11-kit0:0.25.5-3:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11_kit0:0.25.5-3:*:*:*:*:*:*:*"],"name":"libp11-kit0","purl":"pkg:deb/debian/libp11-kit0@0.25.5-3?arch=arm64&distro=debian-13.7&upstream=p11-kit","type":"deb","version":"0.25.5-3","language":"","licenses":["Apache-2.0","BSD-3-clause","FSFAP","FSFULLR","GPL-2+","GPL-3+","ISC","LGPL-2.1","LGPL-2.1+","X11","customFSFUL","customFSFULLRWD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libp11-kit0/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libp11-kit0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libp11-kit0:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libp11-kit0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"p11-kit"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18938","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"p11-kit","version":"0.25.5-3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-18938","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18938","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18938","date":"2026-10-17","epss":0.00152,"percentile":0.0397}],"risk":0.08512000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-18938","description":"A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems."},"relatedVulnerabilities":[{"id":"CVE-2026-18938","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18938","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18938","date":"2026-10-17","epss":0.00152,"percentile":0.0397}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18938","https://bugzilla.redhat.com/show_bug.cgi?id=2478995"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18938","description":"A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems."}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34933","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34933","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34933","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34933","date":"2026-10-17","epss":0.00161,"percentile":0.04898}],"risk":0.084525,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34933","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4."},"relatedVulnerabilities":[{"id":"CVE-2026-34933","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34933","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34933","date":"2026-10-17","epss":0.00161,"percentile":0.04898}],"urls":["https://github.com/avahi/avahi/commit/625ca0fac19229f6dfa3a6c6b698ae657187e50c","https://github.com/avahi/avahi/pull/891","https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc","http://www.openwall.com/lists/oss-security/2026/04/11/9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34933","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34933","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34933","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34933","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34933","date":"2026-10-17","epss":0.00161,"percentile":0.04898}],"risk":0.084525,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34933","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4."},"relatedVulnerabilities":[{"id":"CVE-2026-34933","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34933","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34933","date":"2026-10-17","epss":0.00161,"percentile":0.04898}],"urls":["https://github.com/avahi/avahi/commit/625ca0fac19229f6dfa3a6c6b698ae657187e50c","https://github.com/avahi/avahi/pull/891","https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc","http://www.openwall.com/lists/oss-security/2026/04/11/9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34933","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34933","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-34933","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34933","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34933","date":"2026-10-17","epss":0.00161,"percentile":0.04898}],"risk":0.084525,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-34933","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4."},"relatedVulnerabilities":[{"id":"CVE-2026-34933","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34933","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-34933","date":"2026-10-17","epss":0.00161,"percentile":0.04898}],"urls":["https://github.com/avahi/avahi/commit/625ca0fac19229f6dfa3a6c6b698ae657187e50c","https://github.com/avahi/avahi/pull/891","https://github.com/avahi/avahi/security/advisories/GHSA-w65r-6gxh-vhvc","http://www.openwall.com/lists/oss-security/2026/04/11/9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34933","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110170","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110170","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"risk":0.08416499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110170","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/496308073"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110170","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110170","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"risk":0.08416499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110170","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/496308073"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110170","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110170","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"risk":0.08416499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110170","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/496308073"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110170","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110170","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"risk":0.08416499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110170","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/496308073"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110170","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110170","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"risk":0.08416499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110170","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110170","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110170","date":"2026-10-17","epss":0.00181,"percentile":0.07133}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/496308073"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110170","description":"Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"6231d5d7bc75633b","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=sqlite3","type":"deb","version":"3.46.1-7+deb13u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libsqlite3-0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-50812","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"sqlite3","version":"3.46.1-7+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-50812","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-10-17","epss":0.0016,"percentile":0.04731}],"risk":0.084,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-50812","description":"A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer."},"relatedVulnerabilities":[{"id":"CVE-2026-50812","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50812","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50812","date":"2026-10-17","epss":0.0016,"percentile":0.04731}],"urls":["https://gist.github.com/junius-sec/bb556f333957c5226dede314db0e9e91","https://github.com/sqlite/sqlite/commit/b869ed6b067d623cb1383549f2a18aa35508385d","https://sqlite.org/src/info/e807d4e3798efd53"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50812","description":"A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changeset_apply_v3() applies a corrupt changeset and reaches sqlite3_value_type() with a NULL sqlite3_value pointer."}]},{"artifact":{"id":"4f98c505d6a35093","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.10-3\\+deb13u2:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/debian/libcups2t64@2.4.10-3%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=cups","type":"deb","version":"2.4.10-3+deb13u2","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcups2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-55480","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cups","version":"2.4.10-3+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-55480","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":5.7,"impactScore":5.2,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55480","cwe":"CWE-59","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55480","cwe":"CWE-377","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55480","date":"2026-10-17","epss":0.00157,"percentile":0.04373}],"risk":0.083995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-55480","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20."},"relatedVulnerabilities":[{"id":"CVE-2026-55480","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":5.7,"impactScore":5.2,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55480","cwe":"CWE-59","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-55480","cwe":"CWE-377","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-55480","date":"2026-10-17","epss":0.00157,"percentile":0.04373}],"urls":["https://github.com/OpenPrinting/cups/commit/98adfd855950e806508f961d5438ad32e26aac62","https://github.com/OpenPrinting/cups/commit/f6a11dae0f0f3b748fbca931e237be03ffe8e48e","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-jj94-x3qh-ffp9"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55480","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20."}]},{"artifact":{"id":"6231d5d7bc75633b","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=sqlite3","type":"deb","version":"3.46.1-7+deb13u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libsqlite3-0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-50813","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"sqlite3","version":"3.46.1-7+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-50813","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50813","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50813","date":"2026-10-17","epss":0.00159,"percentile":0.0456}],"risk":0.08347500000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-50813","description":"An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path"},"relatedVulnerabilities":[{"id":"CVE-2026-50813","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50813","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-50813","date":"2026-10-17","epss":0.00159,"percentile":0.0456}],"urls":["https://gist.github.com/junius-sec/f8acb66bafb80134c8e1a1c8c7c9f4f4","https://github.com/sqlite/sqlite/commit/c597ed79d1bd03f57198d10d1f431adda293cf2e","https://sqlite.org/src/info/869a51ae84df"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50813","description":"An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path"}]},{"artifact":{"id":"4f2a5761d593b16d","cpes":["cpe:2.3:a:libasound2-data:libasound2-data:1.2.14-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libasound2-data:libasound2_data:1.2.14-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libasound2_data:libasound2-data:1.2.14-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libasound2_data:libasound2_data:1.2.14-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libasound2:libasound2-data:1.2.14-1\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libasound2:libasound2_data:1.2.14-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libasound2-data","purl":"pkg:deb/debian/libasound2-data@1.2.14-1%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=alsa-lib","type":"deb","version":"1.2.14-1+deb13u1","language":"","licenses":["LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libasound2-data/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libasound2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libasound2-data.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libasound2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libasound2-data.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libasound2-data.list"}],"upstreams":[{"name":"alsa-lib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"alsa-lib","version":"1.2.14-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-90781","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-17","epss":0.0017,"percentile":0.05972}],"risk":0.0833,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."},"relatedVulnerabilities":[{"id":"CVE-2026-90781","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-17","epss":0.0017,"percentile":0.05972}],"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."}]},{"artifact":{"id":"7b18ab66750e4267","cpes":["cpe:2.3:a:libasound2t64:libasound2t64:1.2.14-1\\+deb13u1:*:*:*:*:*:*:*"],"name":"libasound2t64","purl":"pkg:deb/debian/libasound2t64@1.2.14-1%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=alsa-lib","type":"deb","version":"1.2.14-1+deb13u1","language":"","licenses":["LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libasound2t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libasound2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libasound2t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libasound2t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"alsa-lib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"alsa-lib","version":"1.2.14-1+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-90781","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-17","epss":0.0017,"percentile":0.05972}],"risk":0.0833,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."},"relatedVulnerabilities":[{"id":"CVE-2026-90781","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90781","cwe":"CWE-193","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-90781","date":"2026-10-17","epss":0.0017,"percentile":0.05972}],"urls":["https://github.com/alsa-project/alsa-lib","https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/control/ctlparse.c#L216-L241","https://github.com/alsa-project/alsa-lib/commit/f84cd4ced7b36fddb8e4ee24404cf7c091d27020","https://lore.kernel.org/alsa-devel/CACBQ=P2FhO3M6dkv3cWuKb6Qhs92ouV+FJ3SJZ_PVBSSdJWRAQ@mail.gmail.com/","https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-off-by-one-stack-buffer-overflow-in-snd-ctl-ascii-elem-id-parse"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90781","description":"alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110917","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110917","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110917","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569038297"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110918","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110918","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110918","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568937999"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110917","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110917","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110917","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569038297"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110918","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110918","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110918","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568937999"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110917","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110917","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110917","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569038297"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110918","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110918","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110918","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568937999"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110917","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110917","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110917","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569038297"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110918","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110918","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110918","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568937999"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110917","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110917","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110917","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110917","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110917","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/569038297"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110917","description":"Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110918","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110918","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"risk":0.08277,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110918","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110918","cwe":"CWE-119","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110918","date":"2026-10-17","epss":0.00178,"percentile":0.06904}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01886704284.html","https://issues.chromium.org/issues/568937999"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110918","description":"Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2b954dd82088269d","cpes":["cpe:2.3:a:libattr1:libattr1:1\\:2.5.2-3:*:*:*:*:*:*:*"],"name":"libattr1","purl":"pkg:deb/debian/libattr1@1%3A2.5.2-3?arch=arm64&distro=debian-13.7&upstream=attr","type":"deb","version":"1:2.5.2-3","language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libattr1/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libattr1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libattr1:arm64.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libattr1:arm64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libattr1:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libattr1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"attr"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54371","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"attr","version":"1:2.5.2-3"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-54371","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54371","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54371","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54371","date":"2026-10-17","epss":0.00146,"percentile":0.03416}],"risk":0.08248999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-54371","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path."},"relatedVulnerabilities":[{"id":"CVE-2026-54371","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54371","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54371","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54371","date":"2026-10-17","epss":0.00146,"percentile":0.03416}],"urls":["https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f","https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b","https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr","https://access.redhat.com/errata/RHSA-2026:34889","https://access.redhat.com/errata/RHSA-2026:56133","https://access.redhat.com/errata/RHSA-2026:59380","https://access.redhat.com/errata/RHSA-2026:60226","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:63135","https://access.redhat.com/errata/RHSA-2026:63138","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/security/cve/CVE-2026-54371","https://bugzilla.redhat.com/show_bug.cgi?id=2490283","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54371","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path."}]},{"artifact":{"id":"4ecf19088377af64","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/debian/libavahi-client3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-client3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68276","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68276","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68276","date":"2026-10-17","epss":0.00156,"percentile":0.04327}],"risk":0.0819,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68276","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves."},"relatedVulnerabilities":[{"id":"CVE-2025-68276","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68276","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68276","date":"2026-10-17","epss":0.00156,"percentile":0.04327}],"urls":["https://github.com/avahi/avahi/commit/ede7048475c5d47d53890e3bc1350dda8e0b3688","https://github.com/avahi/avahi/pull/806","https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68276","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling\nthe RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves."}]},{"artifact":{"id":"c7472053ac017f54","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/debian/libavahi-common-data@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common-data:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68276","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68276","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68276","date":"2026-10-17","epss":0.00156,"percentile":0.04327}],"risk":0.0819,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68276","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves."},"relatedVulnerabilities":[{"id":"CVE-2025-68276","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68276","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68276","date":"2026-10-17","epss":0.00156,"percentile":0.04327}],"urls":["https://github.com/avahi/avahi/commit/ede7048475c5d47d53890e3bc1350dda8e0b3688","https://github.com/avahi/avahi/pull/806","https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68276","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling\nthe RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves."}]},{"artifact":{"id":"e805de280e250033","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-16:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-16:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/debian/libavahi-common3@0.8-16?arch=arm64&distro=debian-13.7&upstream=avahi","type":"deb","version":"0.8-16","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libavahi-common3:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-68276","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"avahi","version":"0.8-16"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2025-68276","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68276","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68276","date":"2026-10-17","epss":0.00156,"percentile":0.04327}],"risk":0.0819,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68276","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling the RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves."},"relatedVulnerabilities":[{"id":"CVE-2025-68276","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68276","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-68276","date":"2026-10-17","epss":0.00156,"percentile":0.04327}],"urls":["https://github.com/avahi/avahi/commit/ede7048475c5d47d53890e3bc1350dda8e0b3688","https://github.com/avahi/avahi/pull/806","https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68276","description":"Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon (with wide-area disabled) by creating record browsers with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by either calling\nthe RecordBrowserNew method directly or creating hostname/address/service resolvers/browsers that create those browsers internally themselves."}]},{"artifact":{"id":"1e539cf5aec9013f","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.8.3-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.8.3-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=expat","type":"deb","version":"2.8.3-1~deb13u1","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","layerID":"sha256:094d43e6c4e76994ab814c2af88e34d28a2aec552f360513dad9072c3b5538d5","accessPath":"/var/lib/dpkg/info/libexpat1:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.0-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76957","versionConstraint":"< 2.9.0-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"expat","version":"2.8.3-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-76957","fix":{"state":"fixed","versions":["2.9.0-1~deb13u1"],"available":[{"date":"2026-10-16","kind":"advisory","version":"2.9.0-1~deb13u1"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76957","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76957","date":"2026-10-17","epss":0.00107,"percentile":0.01061}],"risk":0.081855,"urls":[],"severity":"High","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6566-1","link":"https://security-tracker.debian.org/tracker/DSA-6566-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-76957","description":"libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412."},"relatedVulnerabilities":[{"id":"CVE-2026-76957","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76957","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-76957","date":"2026-10-17","epss":0.00107,"percentile":0.01061}],"urls":["https://github.com/libexpat/libexpat/pull/1322","https://github.com/libexpat/libexpat/pull/1329"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76957","description":"libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412."}]},{"artifact":{"id":"6231d5d7bc75633b","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.46.1-7\\+deb13u2:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.46.1-7%2Bdeb13u2?arch=arm64&distro=debian-13.7&upstream=sqlite3","type":"deb","version":"3.46.1-7+deb13u2","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:arm64.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libsqlite3-0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-45346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"sqlite3","version":"3.46.1-7+deb13u2"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2021-45346","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-45346","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-45346","date":"2026-10-17","epss":0.01628,"percentile":0.75784}],"risk":0.0814,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2021-45346","description":"A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect."},"relatedVulnerabilities":[{"id":"CVE-2021-45346","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-45346","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-45346","date":"2026-10-17","epss":0.01628,"percentile":0.75784}],"urls":["https://github.com/guyinatuxedo/sqlite3_record_leaking","https://security.netapp.com/advisory/ntap-20220303-0001/","https://sqlite.org/forum/forumpost/056d557c2f8c452ed5","https://sqlite.org/forum/forumpost/53de8864ba114bf6","https://www.sqlite.org/cves.html#status_of_recent_sqlite_cves"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-45346","description":"A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect."}]},{"artifact":{"id":"8055dc5b89c3a3db","cpes":["cpe:2.3:a:chromium:chromium:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium","purl":"pkg:deb/debian/chromium@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.conffiles","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.list"},{"path":"/var/lib/dpkg/info/chromium.postinst","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.postinst"},{"path":"/var/lib/dpkg/info/chromium.prerm","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-110160","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110160","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"risk":0.07498,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110160","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/552510359"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"96b2a649162d762b","cpes":["cpe:2.3:a:chromium-common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_common:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_common:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-common","purl":"pkg:deb/debian/chromium-common@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.list"},{"path":"/var/lib/dpkg/info/chromium-common.shlibs","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.shlibs"},{"path":"/var/lib/dpkg/info/chromium-common.triggers","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-common.triggers"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110160","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110160","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"risk":0.07498,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110160","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/552510359"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"39a79c14e12c23d7","cpes":["cpe:2.3:a:chromium-driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_driver:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_driver:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-driver","purl":"pkg:deb/debian/chromium-driver@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-driver/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-driver/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-driver.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-driver.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110160","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110160","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"risk":0.07498,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110160","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/552510359"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"874d1fb984d7ccb8","cpes":["cpe:2.3:a:chromium-sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_sandbox:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_sandbox:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-sandbox","purl":"pkg:deb/debian/chromium-sandbox@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-sandbox/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-sandbox/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-sandbox.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-sandbox.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110160","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110160","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"risk":0.07498,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110160","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/552510359"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"2341599be3c821e9","cpes":["cpe:2.3:a:chromium-shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium-shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium_shell:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium-shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:chromium:chromium_shell:155.0.8059.39-1\\~deb13u1:*:*:*:*:*:*:*"],"name":"chromium-shell","purl":"pkg:deb/debian/chromium-shell@155.0.8059.39-1~deb13u1?arch=arm64&distro=debian-13.7&upstream=chromium","type":"deb","version":"155.0.8059.39-1~deb13u1","language":"","licenses":["Apache-2.0","Apple-license","BSD-2-clause","BSD-3-clause","BSL-1","GPL-2","GPL-2+","GPL-2.0","GPL-3","GPL-3+","ICU","ISC","LGPL-2","LGPL-2+","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","MIT","MPL-1.1","MPL-2.0","Ms-PL","Public-domain","Unicode","zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/chromium-shell/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/chromium-shell/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/chromium-shell.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/chromium-shell.list"}],"upstreams":[{"name":"chromium"}]},"matchDetails":[{"fix":{"suggestedVersion":"155.0.8059.79-1~deb13u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-110160","versionConstraint":"< 155.0.8059.79-1~deb13u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"chromium","version":"155.0.8059.39-1~deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-110160","fix":{"state":"fixed","versions":["155.0.8059.79-1~deb13u1"],"available":[{"date":"2026-10-15","kind":"advisory","version":"155.0.8059.79-1~deb13u1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"risk":0.07498,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[{"id":"DSA-6562-1","link":"https://security-tracker.debian.org/tracker/DSA-6562-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"},"relatedVulnerabilities":[{"id":"CVE-2026-110160","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-110160","cwe":"CWE-862","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-110160","date":"2026-10-17","epss":0.00163,"percentile":0.05114}],"urls":["https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_01668083673.html","https://issues.chromium.org/issues/552510359"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110160","description":"Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"3a3de47e33e1d8aa","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.4-1\\+b1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/debian/libcairo-gobject2@1.18.4-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=cairo%401.18.4-1","type":"deb","version":"1.18.4-1+b1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo","version":"1.18.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cairo","version":"1.18.4-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-17","epss":0.0148,"percentile":0.73487}],"risk":0.07400000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-17","epss":0.0148,"percentile":0.73487}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"0522bb7de4d00cc0","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.4-1\\+b1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/debian/libcairo2@1.18.4-1%2Bb1?arch=arm64&distro=debian-13.7&upstream=cairo%401.18.4-1","type":"deb","version":"1.18.4-1+b1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libcairo2:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo","version":"1.18.4-1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"cairo","version":"1.18.4-1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-17","epss":0.0148,"percentile":0.73487}],"risk":0.07400000000000001,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-17","epss":0.0148,"percentile":0.73487}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"d8fc8f8dd42428d3","cpes":["cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf-2.0-0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf_2.0_0:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf-2.0-0","purl":"pkg:deb/debian/libgdk-pixbuf-2.0-0@2.42.12%2Bdfsg-4%2Bdeb13u1?arch=arm64&distro=debian-13.7&upstream=gdk-pixbuf","type":"deb","version":"2.42.12+dfsg-4+deb13u1","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-81893","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gdk-pixbuf","version":"2.42.12+dfsg-4+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-81893","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81893","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-81893","date":"2026-10-17","epss":0.00152,"percentile":0.03955}],"risk":0.07372000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-81893","description":"A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image.  Affected version >= 2.26.4"},"relatedVulnerabilities":[{"id":"CVE-2026-81893","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81893","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-81893","date":"2026-10-17","epss":0.00152,"percentile":0.03955}],"urls":["https://access.redhat.com/security/cve/CVE-2026-81893","https://bugzilla.redhat.com/show_bug.cgi?id=2524834","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/efe658674bd103d1c9bf50809d5767a3f6dd5a01","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/278"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81893","description":"A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image.\n\nAffected version >= 2.26.4"}]},{"artifact":{"id":"920fc5b9189a88b5","cpes":["cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf2.0-common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf2.0_common:2.42.12\\+dfsg-4\\+deb13u1:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf2.0-common","purl":"pkg:deb/debian/libgdk-pixbuf2.0-common@2.42.12%2Bdfsg-4%2Bdeb13u1?arch=all&distro=debian-13.7&upstream=gdk-pixbuf","type":"deb","version":"2.42.12+dfsg-4+deb13u1","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list"}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-81893","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"gdk-pixbuf","version":"2.42.12+dfsg-4+deb13u1"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-81893","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81893","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-81893","date":"2026-10-17","epss":0.00152,"percentile":0.03955}],"risk":0.07372000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-81893","description":"A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image.  Affected version >= 2.26.4"},"relatedVulnerabilities":[{"id":"CVE-2026-81893","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81893","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-81893","date":"2026-10-17","epss":0.00152,"percentile":0.03955}],"urls":["https://access.redhat.com/security/cve/CVE-2026-81893","https://bugzilla.redhat.com/show_bug.cgi?id=2524834","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/efe658674bd103d1c9bf50809d5767a3f6dd5a01","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/278"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81893","description":"A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image.\n\nAffected version >= 2.26.4"}]},{"artifact":{"id":"0afd960a047202b3","cpes":["cpe:2.3:a:libglib2.0-0t64:libglib2.0-0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-0t64:libglib2.0_0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0t64:libglib2.0-0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0t64:libglib2.0_0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_0t64:2.84.4-3\\~deb13u5:*:*:*:*:*:*:*"],"name":"libglib2.0-0t64","purl":"pkg:deb/debian/libglib2.0-0t64@2.84.4-3~deb13u5?arch=arm64&distro=debian-13.7&upstream=glib2.0","type":"deb","version":"2.84.4-3~deb13u5","language":"","licenses":["AFL-2.0","Apache-2.0","CC-BY-SA-3.0","CC0-1.0","Expat","FSFULLR","GPL-2","GPL-2+","Iconv-PD","Janik-permissive","Kuchling-PD","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MPL-1.1","Mingw-PD","Plumb-PD","Unicode-DFS-2016","bzip2-1.0.6","cmph","old-glib-tests"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-0t64/copyright","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/usr/share/doc/libglib2.0-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-0t64:arm64.md5sums","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/info/libglib2.0-0t64:arm64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glib2.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86469","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glib2.0","version":"2.84.4-3~deb13u5"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-86469","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86469","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-86469","date":"2026-10-17","epss":0.00141,"percentile":0.03061}],"risk":0.07261500000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-86469","description":"A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file."},"relatedVulnerabilities":[{"id":"CVE-2026-86469","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86469","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-86469","date":"2026-10-17","epss":0.00141,"percentile":0.03061}],"urls":["https://access.redhat.com/security/cve/CVE-2026-86469","https://bugzilla.redhat.com/show_bug.cgi?id=2473839","https://gitlab.gnome.org/GNOME/glib/-/blob/main/gio/glocalfileoutputstream.c","https://gitlab.gnome.org/GNOME/glib/-/work_items/4044"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86469","description":"A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file."}]},{"artifact":{"id":"ed519a14ad86bc48","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.41-12\\+deb13u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.41-12%2Bdeb13u4?arch=arm64&distro=debian-13.7&upstream=glibc","type":"deb","version":"2.41-12+deb13u4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:959dc0f9736790768f2f7c6bc38036aa7d02b06ed32aea8f5f0c79b50ef9f31e","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:3d70f8bfe61d83ca77e6af597587d17eb2507936ea88c91faed16039b36efb13","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"13.7"},"package":{"name":"glibc","version":"2.41-12+deb13u4"},"namespace":"debian:distro:debian:13"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"wont-fix","versions":[]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-17","epss":0.00144,"percentile":0.03295}],"risk":0.07128000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:13","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.    This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-17","epss":0.00144,"percentile":0.03295}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]}],"grade":"F","score":"0.00","as_of":"2026-10-19T04:21:53.064Z","grype_db_version":"2026-10-18T06:27:17.000Z"}