{"grype_matches":[{"artifact":{"id":"bf0b5dc9ecd638c2","cpes":["cpe:2.3:a:libbrotli1:libbrotli1:1.1.0-2build2:*:*:*:*:*:*:*"],"name":"libbrotli1","purl":"pkg:deb/ubuntu/libbrotli1@1.1.0-2build2?arch=amd64&distro=ubuntu-24.04&upstream=brotli","type":"deb","version":"1.1.0-2build2","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbrotli1/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/libbrotli1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbrotli1:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libbrotli1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"brotli"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.1.0-2ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111497","versionConstraint":"< 1.1.0-2ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"brotli","version":"1.1.0-2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-111497","fix":{"state":"fixed","versions":["1.1.0-2ubuntu0.1"],"available":[{"date":"2026-10-26","kind":"advisory","version":"1.1.0-2ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-10-27","epss":0.55483,"percentile":0.9903}],"risk":52.5,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-111497","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-111497","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-111497","cwe":"CWE-252","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-111497","cwe":"CWE-787","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-111497","date":"2026-10-27","epss":0.55483,"percentile":0.9903}],"urls":["https://github.com/andybalholm/brotli/releases/tag/v1.2.7","https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high","http://www.openwall.com/lists/oss-security/2026/10/23/25","http://www.openwall.com/lists/oss-security/2026/10/24/6","http://www.openwall.com/lists/oss-security/2026/10/26/12","http://www.openwall.com/lists/oss-security/2026/10/26/13","http://www.openwall.com/lists/oss-security/2026/10/26/16","https://broccoli2shell.com","https://github.com/advisories/GHSA-9v8h-qqgm-4m35","https://github.com/dotnet/announcements/issues/494","https://github.com/google/brotli/releases/tag/v1.0.10","https://github.com/google/brotli/releases/tag/v1.1.1","https://github.com/google/brotli/releases/tag/v1.2.1","https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html","https://patchtheplanet.org/brotli","https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497","https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497","description":"A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.","knownExploited":[{"cve":"CVE-2026-111497","cwes":["CWE-252","CWE-787"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-111497"],"notes":"This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/google/brotli/releases/tag/v1.2.1; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-10","product":"Brotli","dateAdded":"2026-10-27","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"52bcf6f4517919c7","cpes":["cpe:2.3:a:x11vnc:x11vnc:0.9.16-10:*:*:*:*:*:*:*"],"name":"x11vnc","purl":"pkg:deb/ubuntu/x11vnc@0.9.16-10?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.9.16-10","language":"","licenses":["GPL-2","GPL-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/x11vnc/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/x11vnc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32854","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"x11vnc","version":"0.9.16-10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32854","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32854","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-32854","date":"2026-10-27","epss":0.05415,"percentile":0.92654}],"risk":2.7075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32854"},"relatedVulnerabilities":[{"id":"CVE-2026-32854","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32854","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-32854","date":"2026-10-27","epss":0.05415,"percentile":0.92654}],"urls":["https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314","https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x","https://www.vulncheck.com/advisories/libvncserver-httpd-proxy-null-pointer-dereference"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32854","description":"LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-27","epss":0.04697,"percentile":0.91752}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-27","epss":0.04697,"percentile":0.91752}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-27","epss":0.04697,"percentile":0.91752}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-27","epss":0.04697,"percentile":0.91752}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-5271","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2014-5271","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-27","epss":0.04697,"percentile":0.91752}],"risk":2.3485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2014-5271"},"relatedVulnerabilities":[{"id":"CVE-2014-5271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-5271","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-5271","date":"2026-10-27","epss":0.04697,"percentile":0.91752}],"urls":["http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=52b81ff4635c077b2bc8b8d3637d933b6629d803","http://www.osvdb.org/111725","http://www.securityfocus.com/bid/69250","https://security.gentoo.org/glsa/201603-06","https://www.ffmpeg.org/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-5271","description":"Heap-based buffer overflow in the encode_slice function in libavcodec/proresenc_kostya.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.x before 2.2.7, and 2.3.x before 2.3.3 and Libav before 10.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-92392","versionConstraint":">= 8.12.0, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-20","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-20","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-20","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-20","kind":"first-observed","version":"8.23.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-10-27","epss":0.01284,"percentile":0.69965}],"risk":1.00152,"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."},"relatedVulnerabilities":[]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-27","epss":0.01572,"percentile":0.75272}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-27","epss":0.01572,"percentile":0.75272}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-27","epss":0.01572,"percentile":0.75272}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-27","epss":0.01572,"percentile":0.75272}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-27","epss":0.01572,"percentile":0.75272}],"risk":0.786,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8461"},"relatedVulnerabilities":[{"id":"CVE-2026-8461","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2026-8461","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8461","date":"2026-10-27","epss":0.01572,"percentile":0.75272}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23159","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/security/cve/CVE-2026-8461","https://bugzilla.redhat.com/show_bug.cgi?id=2490308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8461.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8461","description":"An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution.\n\n This vulnerability is associated with the file libavcodec/magicyuv.C.\n\n\n\nThis issue affects FFmpeg before version 8.1.2."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-27","epss":0.01533,"percentile":0.74667}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-27","epss":0.01533,"percentile":0.74667}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-27","epss":0.01533,"percentile":0.74667}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-27","epss":0.01533,"percentile":0.74667}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49502","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49502","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-27","epss":0.01533,"percentile":0.74667}],"risk":0.7665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49502"},"relatedVulnerabilities":[{"id":"CVE-2023-49502","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49502","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49502","date":"2026-10-27","epss":0.01533,"percentile":0.74667}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10688","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49502","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ff_bwdif_filter_intra_c function in the libavfilter/bwdifdsp.c:125:5 component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-27","epss":0.01436,"percentile":0.72992}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-27","epss":0.01436,"percentile":0.72992}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-27","epss":0.01436,"percentile":0.72992}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-27","epss":0.01436,"percentile":0.72992}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-27","epss":0.01436,"percentile":0.72992}],"risk":0.718,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7055"},"relatedVulnerabilities":[{"id":"CVE-2024-7055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7055","cwe":"CWE-122","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2024-7055","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7055","date":"2026-10-27","epss":0.01436,"percentile":0.72992}],"urls":["https://ffmpeg.org/","https://ffmpeg.org/download.html","https://github.com/CookedMelon/ReportCVE/tree/main/FFmpeg/poc3","https://vuldb.com/?ctiid.273651","https://vuldb.com/?id.273651","https://vuldb.com/?submit.376532","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=ceeb1928da9a3aedd6fff935790c70405d4b12bf","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=d0ce252930357406a0435d0d783db4b1467345aa","https://git.videolan.org/?p=ffmpeg.git;a=commit;h=da2240ccbecdf3fe8df6465ae3de7a1b565a2c68","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3faadbe2a27e74ff5bb5f7904ec27bb1f5287dc8","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5372bfe01e4a04357ab4465c1426cf8c6412dfd5","https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=587acd0d4020859e67d1f07aeff2c885797ebcce"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7055","description":"A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-27","epss":0.01179,"percentile":0.67514}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-27","epss":0.01179,"percentile":0.67514}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-27","epss":0.01179,"percentile":0.67514}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-27","epss":0.01179,"percentile":0.67514}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31578","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31578","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-27","epss":0.01179,"percentile":0.67514}],"risk":0.5895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31578"},"relatedVulnerabilities":[{"id":"CVE-2024-31578","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31578","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31578","date":"2026-10-27","epss":0.01179,"percentile":0.67514}],"urls":["https://gist.github.com/1047524396/45400cce5859d78dcd3a62010df8d179","https://github.com/ffmpeg/ffmpeg/commit/3bb00c0a420c3ce83c6fafee30270d69622ccad7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.debian.org/debian-lts-announce/2024/10/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31578","description":"FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6612","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-27","epss":0.00622,"percentile":0.49589}],"risk":0.56291,"urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847187","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."},"relatedVulnerabilities":[{"id":"CVE-2026-78663","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-27","epss":0.00622,"percentile":0.49589}],"urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}]},{"artifact":{"id":"1fe29ec161099bff","cpes":["cpe:2.3:a:wget:wget:1.21.4-1ubuntu4.5:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/ubuntu/wget@1.21.4-1ubuntu4.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.21.4-1ubuntu4.5","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-31879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"wget","version":"1.21.4-1ubuntu4.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2021-31879","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-10-27","epss":0.01104,"percentile":0.65586}],"risk":0.5519999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-31879"},"relatedVulnerabilities":[{"id":"CVE-2021-31879","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-31879","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-31879","date":"2026-10-27","epss":0.01104,"percentile":0.65586}],"urls":["https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html","https://security.netapp.com/advisory/ntap-20210618-0002/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-31879","description":"GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007."}]},{"artifact":{"id":"0fd35fb8ec6e7447","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/ubuntu/libcairo-gobject2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-27","epss":0.01824,"percentile":0.78682}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-27","epss":0.01824,"percentile":0.78682}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7475","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2017-7475","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-27","epss":0.01824,"percentile":0.78682}],"risk":0.5471999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7475"},"relatedVulnerabilities":[{"id":"CVE-2017-7475","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7475","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7475","date":"2026-10-27","epss":0.01824,"percentile":0.78682}],"urls":["http://seclists.org/oss-sec/2017/q2/151","https://bugs.freedesktop.org/show_bug.cgi?id=100763","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7475","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7475","description":"Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-10126","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-27","epss":0.0182,"percentile":0.78631}],"risk":0.546,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-10126"},"relatedVulnerabilities":[{"id":"CVE-2018-10126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-27","epss":0.0182,"percentile":0.78631}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2786","https://gitlab.com/libtiff/libtiff/-/issues/128","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-1761","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1761","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-1761","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-1761","date":"2026-10-27","epss":0.01075,"percentile":0.64806}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1761"},"relatedVulnerabilities":[{"id":"CVE-2026-1761","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1761","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-1761","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-1761","date":"2026-10-27","epss":0.01075,"percentile":0.64806}],"urls":["https://access.redhat.com/errata/RHSA-2026:1948","https://access.redhat.com/errata/RHSA-2026:2005","https://access.redhat.com/errata/RHSA-2026:2006","https://access.redhat.com/errata/RHSA-2026:2007","https://access.redhat.com/errata/RHSA-2026:2008","https://access.redhat.com/errata/RHSA-2026:2049","https://access.redhat.com/errata/RHSA-2026:2182","https://access.redhat.com/errata/RHSA-2026:2214","https://access.redhat.com/errata/RHSA-2026:2215","https://access.redhat.com/errata/RHSA-2026:2216","https://access.redhat.com/errata/RHSA-2026:2396","https://access.redhat.com/errata/RHSA-2026:2402","https://access.redhat.com/errata/RHSA-2026:2410","https://access.redhat.com/errata/RHSA-2026:2512","https://access.redhat.com/errata/RHSA-2026:2513","https://access.redhat.com/errata/RHSA-2026:2514","https://access.redhat.com/errata/RHSA-2026:2528","https://access.redhat.com/errata/RHSA-2026:2529","https://access.redhat.com/errata/RHSA-2026:2628","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/security/cve/CVE-2026-1761","https://bugzilla.redhat.com/show_bug.cgi?id=2435961","https://gitlab.gnome.org/GNOME/libsoup/-/issues/493","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1761.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1761","description":"A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-1761","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1761","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-1761","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-1761","date":"2026-10-27","epss":0.01075,"percentile":0.64806}],"risk":0.5375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1761"},"relatedVulnerabilities":[{"id":"CVE-2026-1761","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1761","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-1761","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-1761","date":"2026-10-27","epss":0.01075,"percentile":0.64806}],"urls":["https://access.redhat.com/errata/RHSA-2026:1948","https://access.redhat.com/errata/RHSA-2026:2005","https://access.redhat.com/errata/RHSA-2026:2006","https://access.redhat.com/errata/RHSA-2026:2007","https://access.redhat.com/errata/RHSA-2026:2008","https://access.redhat.com/errata/RHSA-2026:2049","https://access.redhat.com/errata/RHSA-2026:2182","https://access.redhat.com/errata/RHSA-2026:2214","https://access.redhat.com/errata/RHSA-2026:2215","https://access.redhat.com/errata/RHSA-2026:2216","https://access.redhat.com/errata/RHSA-2026:2396","https://access.redhat.com/errata/RHSA-2026:2402","https://access.redhat.com/errata/RHSA-2026:2410","https://access.redhat.com/errata/RHSA-2026:2512","https://access.redhat.com/errata/RHSA-2026:2513","https://access.redhat.com/errata/RHSA-2026:2514","https://access.redhat.com/errata/RHSA-2026:2528","https://access.redhat.com/errata/RHSA-2026:2529","https://access.redhat.com/errata/RHSA-2026:2628","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/security/cve/CVE-2026-1761","https://bugzilla.redhat.com/show_bug.cgi?id=2435961","https://gitlab.gnome.org/GNOME/libsoup/-/issues/493","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1761.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1761","description":"A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart HTTP response, which can lead to memory corruption. This issue may result in application crashes or arbitrary code execution in applications that process untrusted server responses, and it does not require authentication or user interaction."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6604","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6604","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-27","epss":0.00553,"percentile":0.46025}],"risk":0.5198200000000001,"urls":["https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847305","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."},"relatedVulnerabilities":[{"id":"CVE-2026-56857","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-27","epss":0.00553,"percentile":0.46025}],"urls":["https://go.dev/cl/847305","https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6604"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2019-6988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-27","epss":0.01724,"percentile":0.77396}],"risk":0.5172,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6988"},"relatedVulnerabilities":[{"id":"CVE-2019-6988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6988","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-6988","date":"2026-10-27","epss":0.01724,"percentile":0.77396}],"urls":["http://www.securityfocus.com/bid/106785","https://github.com/uclouvain/openjpeg/issues/1178"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6988","description":"An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress."}]},{"artifact":{"id":"80a5b5c0b376d026","cpes":["cpe:2.3:a:xterm:xterm:390-1ubuntu3:*:*:*:*:*:*:*"],"name":"xterm","purl":"pkg:deb/ubuntu/xterm@390-1ubuntu3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"390-1ubuntu3","language":"","licenses":["sha256:2c73497c42c9942dd75ee214a2b48a087b91413a8f0f3c66f029b6de433345db"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xterm/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/xterm/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xterm.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/xterm.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xterm.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/xterm.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xterm.list","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/xterm.list"},{"path":"/var/lib/dpkg/info/xterm.postinst","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/xterm.postinst"},{"path":"/var/lib/dpkg/info/xterm.prerm","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/xterm.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-24130","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xterm","version":"390-1ubuntu3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2022-24130","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-24130","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24130","date":"2026-10-27","epss":0.0168,"percentile":0.76818}],"risk":0.5039999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-24130"},"relatedVulnerabilities":[{"id":"CVE-2022-24130","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.6,"impactScore":2.9,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24130","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24130","date":"2026-10-27","epss":0.0168,"percentile":0.76818}],"urls":["https://invisible-island.net/xterm/xterm.log.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP5Y4O7WBNLV24D22E6LE7RQFYOUVD2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4CWYYEBT6AJRJBBQU2KLUOQDHRM7WAV/","https://security.gentoo.org/glsa/202208-22","https://twitter.com/nickblack/status/1487731459398025216","https://www.openwall.com/lists/oss-security/2022/01/30/2","https://www.openwall.com/lists/oss-security/2022/01/30/3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24130","description":"xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6603","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-27","epss":0.00627,"percentile":0.49861}],"risk":0.47025,"urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847185","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."},"relatedVulnerabilities":[{"id":"CVE-2026-78659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-27","epss":0.00627,"percentile":0.49861}],"urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6611","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-27","epss":0.00614,"percentile":0.49201}],"risk":0.46049999999999996,"urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847186","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."},"relatedVulnerabilities":[{"id":"CVE-2026-78669","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-27","epss":0.00614,"percentile":0.49201}],"urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-32049","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-32049","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32049","date":"2026-10-27","epss":0.00889,"percentile":0.59145}],"risk":0.4445,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32049"},"relatedVulnerabilities":[{"id":"CVE-2025-32049","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32049","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32049","date":"2026-10-27","epss":0.00889,"percentile":0.59145}],"urls":["https://access.redhat.com/errata/RHSA-2025:21657","https://access.redhat.com/errata/RHSA-2025:8126","https://access.redhat.com/errata/RHSA-2025:8128","https://access.redhat.com/errata/RHSA-2025:8132","https://access.redhat.com/errata/RHSA-2025:8139","https://access.redhat.com/errata/RHSA-2025:8140","https://access.redhat.com/errata/RHSA-2025:8252","https://access.redhat.com/errata/RHSA-2025:8480","https://access.redhat.com/errata/RHSA-2025:8481","https://access.redhat.com/errata/RHSA-2025:8482","https://access.redhat.com/errata/RHSA-2025:8663","https://access.redhat.com/errata/RHSA-2025:9179","https://access.redhat.com/security/cve/CVE-2025-32049","https://bugzilla.redhat.com/show_bug.cgi?id=2357066","https://gitlab.gnome.org/GNOME/libsoup/-/issues/390","https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32049","description":"A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS)."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-32049","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-32049","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32049","date":"2026-10-27","epss":0.00889,"percentile":0.59145}],"risk":0.4445,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32049"},"relatedVulnerabilities":[{"id":"CVE-2025-32049","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32049","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32049","date":"2026-10-27","epss":0.00889,"percentile":0.59145}],"urls":["https://access.redhat.com/errata/RHSA-2025:21657","https://access.redhat.com/errata/RHSA-2025:8126","https://access.redhat.com/errata/RHSA-2025:8128","https://access.redhat.com/errata/RHSA-2025:8132","https://access.redhat.com/errata/RHSA-2025:8139","https://access.redhat.com/errata/RHSA-2025:8140","https://access.redhat.com/errata/RHSA-2025:8252","https://access.redhat.com/errata/RHSA-2025:8480","https://access.redhat.com/errata/RHSA-2025:8481","https://access.redhat.com/errata/RHSA-2025:8482","https://access.redhat.com/errata/RHSA-2025:8663","https://access.redhat.com/errata/RHSA-2025:9179","https://access.redhat.com/security/cve/CVE-2025-32049","https://bugzilla.redhat.com/show_bug.cgi?id=2357066","https://gitlab.gnome.org/GNOME/libsoup/-/issues/390","https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32049","description":"A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS)."}]},{"artifact":{"id":"0fd35fb8ec6e7447","cpes":["cpe:2.3:a:libcairo-gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo-gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo_gobject2:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo-gobject2:1.18.0-3build1:*:*:*:*:*:*:*","cpe:2.3:a:libcairo:libcairo_gobject2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo-gobject2","purl":"pkg:deb/ubuntu/libcairo-gobject2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo-gobject2/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libcairo-gobject2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libcairo-gobject2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-27","epss":0.0148,"percentile":0.7378}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-27","epss":0.0148,"percentile":0.7378}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"0f4dae8a1acbe548","cpes":["cpe:2.3:a:libcairo2:libcairo2:1.18.0-3build1:*:*:*:*:*:*:*"],"name":"libcairo2","purl":"pkg:deb/ubuntu/libcairo2@1.18.0-3build1?arch=amd64&distro=ubuntu-24.04&upstream=cairo","type":"deb","version":"1.18.0-3build1","language":"","licenses":["sha256:408fb9e704e875cd42d432e7c9b3b378f568e3c89db2b5c5ef3d11c025319574"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcairo2/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libcairo2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libcairo2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cairo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cairo","version":"1.18.0-3build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-18064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-27","epss":0.0148,"percentile":0.7378}],"risk":0.44400000000000006,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18064"},"relatedVulnerabilities":[{"id":"CVE-2018-18064","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18064","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18064","date":"2026-10-27","epss":0.0148,"percentile":0.7378}],"urls":["https://gitlab.freedesktop.org/cairo/cairo/issues/341","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18064","description":"cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function)."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15709","cwe":"CWE-409","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15709","date":"2026-10-27","epss":0.00883,"percentile":0.58992}],"risk":0.44149999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15709"},"relatedVulnerabilities":[{"id":"CVE-2026-15709","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15709","cwe":"CWE-409","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15709","date":"2026-10-27","epss":0.00883,"percentile":0.58992}],"urls":["https://access.redhat.com/errata/RHSA-2026:68234","https://access.redhat.com/errata/RHSA-2026:68235","https://access.redhat.com/errata/RHSA-2026:68612","https://access.redhat.com/errata/RHSA-2026:69108","https://access.redhat.com/errata/RHSA-2026:69297","https://access.redhat.com/errata/RHSA-2026:69863","https://access.redhat.com/errata/RHSA-2026:70598","https://access.redhat.com/errata/RHSA-2026:70599","https://access.redhat.com/errata/RHSA-2026:71389","https://access.redhat.com/security/cve/CVE-2026-15709","https://bugzilla.redhat.com/show_bug.cgi?id=2499922","https://gitlab.gnome.org/GNOME/libsoup/-/issues/511"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15709","description":"A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS)."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15709","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15709","cwe":"CWE-409","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15709","date":"2026-10-27","epss":0.00883,"percentile":0.58992}],"risk":0.44149999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15709"},"relatedVulnerabilities":[{"id":"CVE-2026-15709","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15709","cwe":"CWE-409","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15709","date":"2026-10-27","epss":0.00883,"percentile":0.58992}],"urls":["https://access.redhat.com/errata/RHSA-2026:68234","https://access.redhat.com/errata/RHSA-2026:68235","https://access.redhat.com/errata/RHSA-2026:68612","https://access.redhat.com/errata/RHSA-2026:69108","https://access.redhat.com/errata/RHSA-2026:69297","https://access.redhat.com/errata/RHSA-2026:69863","https://access.redhat.com/errata/RHSA-2026:70598","https://access.redhat.com/errata/RHSA-2026:70599","https://access.redhat.com/errata/RHSA-2026:71389","https://access.redhat.com/security/cve/CVE-2026-15709","https://bugzilla.redhat.com/show_bug.cgi?id=2499922","https://gitlab.gnome.org/GNOME/libsoup/-/issues/511"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15709","description":"A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A separate check for decompressed size (max_total_message_size) exists but executes only after inflation is complete, and it is entirely disabled by default for client connections. A remote, unauthenticated attacker can exploit this by sending a small, highly compressed payload (a decompression bomb), causing unbounded memory allocation that triggers an Out-of-Memory (OOM) crash and a Denial of Service (DoS)."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2174","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2174","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-10-27","epss":0.00829,"percentile":0.57321}],"risk":0.41450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2174"},"relatedVulnerabilities":[{"id":"CVE-2025-2174","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-10-27","epss":0.00829,"percentile":0.57321}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299203","https://vuldb.com/?id.299203","https://vuldb.com/?submit.512800"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2174","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2174","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2174","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-10-27","epss":0.00829,"percentile":0.57321}],"risk":0.41450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2174"},"relatedVulnerabilities":[{"id":"CVE-2025-2174","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2174","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2174","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2174","date":"2026-10-27","epss":0.00829,"percentile":0.57321}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299203","https://vuldb.com/?id.299203","https://vuldb.com/?submit.512800"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2174","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to integer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is named ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6607","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6607","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-27","epss":0.00519,"percentile":0.43882}],"risk":0.38925,"urls":["https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847312","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.\n\nWe now reject these as malformed and curb the memory amplification vector as a result."},"relatedVulnerabilities":[{"id":"CVE-2026-97031","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-27","epss":0.00519,"percentile":0.43882}],"urls":["https://go.dev/cl/847312","https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6607"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97031","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6608","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6608","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-27","epss":0.00511,"percentile":0.43397}],"risk":0.38325,"urls":["https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847307","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."},"relatedVulnerabilities":[{"id":"CVE-2026-94440","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-27","epss":0.00511,"percentile":0.43397}],"urls":["https://go.dev/cl/847307","https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6608"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15711","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15711","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15711","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15711","date":"2026-10-27","epss":0.00745,"percentile":0.54594}],"risk":0.3725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15711"},"relatedVulnerabilities":[{"id":"CVE-2026-15711","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15711","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15711","date":"2026-10-27","epss":0.00745,"percentile":0.54594}],"urls":["https://access.redhat.com/errata/RHSA-2026:68234","https://access.redhat.com/errata/RHSA-2026:68235","https://access.redhat.com/errata/RHSA-2026:68266","https://access.redhat.com/errata/RHSA-2026:68612","https://access.redhat.com/errata/RHSA-2026:69108","https://access.redhat.com/errata/RHSA-2026:69297","https://access.redhat.com/errata/RHSA-2026:69863","https://access.redhat.com/errata/RHSA-2026:70598","https://access.redhat.com/errata/RHSA-2026:70599","https://access.redhat.com/errata/RHSA-2026:71389","https://access.redhat.com/security/cve/CVE-2026-15711","https://bugzilla.redhat.com/show_bug.cgi?id=2499924","https://gitlab.gnome.org/GNOME/libsoup/-/issues/515"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15711","description":"A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15711","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15711","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15711","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15711","date":"2026-10-27","epss":0.00745,"percentile":0.54594}],"risk":0.3725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15711"},"relatedVulnerabilities":[{"id":"CVE-2026-15711","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15711","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15711","date":"2026-10-27","epss":0.00745,"percentile":0.54594}],"urls":["https://access.redhat.com/errata/RHSA-2026:68234","https://access.redhat.com/errata/RHSA-2026:68235","https://access.redhat.com/errata/RHSA-2026:68266","https://access.redhat.com/errata/RHSA-2026:68612","https://access.redhat.com/errata/RHSA-2026:69108","https://access.redhat.com/errata/RHSA-2026:69297","https://access.redhat.com/errata/RHSA-2026:69863","https://access.redhat.com/errata/RHSA-2026:70598","https://access.redhat.com/errata/RHSA-2026:70599","https://access.redhat.com/errata/RHSA-2026:71389","https://access.redhat.com/security/cve/CVE-2026-15711","https://bugzilla.redhat.com/show_bug.cgi?id=2499924","https://gitlab.gnome.org/GNOME/libsoup/-/issues/515"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15711","description":"A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles this protocol violation improperly instead of throwing an immediate connection termination error, it triggers a internal processing crash, resulting in a remote denial of service (DoS) for applications utilizing libsoup WebSockets."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6617","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-27","epss":0.0049,"percentile":0.41939}],"risk":0.3675,"urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847188","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."},"relatedVulnerabilities":[{"id":"CVE-2026-97032","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-27","epss":0.0049,"percentile":0.41939}],"urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-27","epss":0.00727,"percentile":0.53937}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-27","epss":0.00727,"percentile":0.53937}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-27","epss":0.00727,"percentile":0.53937}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-27","epss":0.00727,"percentile":0.53937}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64834","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64834","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-27","epss":0.00727,"percentile":0.53937}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64834"},"relatedVulnerabilities":[{"id":"CVE-2026-64834","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64834","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64834","date":"2026-10-27","epss":0.00727,"percentile":0.53937}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/11d5f475be95d22d5f0692220cc772b116abc632","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23663","https://www.vulncheck.com/advisories/ffmpeg-infinite-loop-dos-via-rtp-asf-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64834","description":"FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtp_asf_fix_header function fails to validate a minimum chunksize when iterating over ASF objects, causing the loop pointer to never advance when a chunksize is smaller than the 24-byte minimum ASF object header size, resulting in CPU exhaustion that denies service to legitimate users."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6609","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6609","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-27","epss":0.0048,"percentile":0.41244}],"risk":0.36,"urls":["https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847309","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-78667","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-27","epss":0.0048,"percentile":0.41244}],"urls":["https://go.dev/cl/847309","https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6609"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."}]},{"artifact":{"id":"de4de504f4c55499","cpes":["cpe:2.3:a:libimlib2t64:libimlib2t64:1.12.1-1.1build2:*:*:*:*:*:*:*"],"name":"libimlib2t64","purl":"pkg:deb/ubuntu/libimlib2t64@1.12.1-1.1build2?arch=amd64&distro=ubuntu-24.04&upstream=imlib2","type":"deb","version":"1.12.1-1.1build2","language":"","licenses":["imlib2-license"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libimlib2t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libimlib2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libimlib2t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libimlib2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imlib2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-25448","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imlib2","version":"1.12.1-1.1build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-25448","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-25448","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-25448","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-25448","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25448","date":"2026-10-27","epss":0.00716,"percentile":0.53579}],"risk":0.358,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-25448"},"relatedVulnerabilities":[{"id":"CVE-2024-25448","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25448","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-25448","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-25448","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25448","date":"2026-10-27","epss":0.00716,"percentile":0.53579}],"urls":["https://git.enlightenment.org/old/legacy-imlib2/issues/20","https://github.com/derf/feh/issues/711"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-25448","description":"An issue in the imlib_free_image_and_decache function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-27","epss":0.0071,"percentile":0.5333}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-27","epss":0.0071,"percentile":0.5333}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-27","epss":0.0071,"percentile":0.5333}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-27","epss":0.0071,"percentile":0.5333}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-27","epss":0.0071,"percentile":0.5333}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35368"},"relatedVulnerabilities":[{"id":"CVE-2024-35368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35368","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35368","date":"2026-10-27","epss":0.0071,"percentile":0.5333}],"urls":["https://gist.github.com/1047524396/7e6e47220ae2b2d2fb4611f0d8a31ec5","https://github.com/FFmpeg/FFmpeg/blob/n7.0/libavcodec/rkmppdec.c#L466","https://github.com/ffmpeg/ffmpeg/commit/4513300989502090c4fd6560544dce399a8cd53c","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35368","description":"FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6605","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6605","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-27","epss":0.00473,"percentile":0.40756}],"risk":0.35475,"urls":["https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847306","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."},"relatedVulnerabilities":[{"id":"CVE-2026-56866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-27","epss":0.00473,"percentile":0.40756}],"urls":["https://go.dev/cl/847306","https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6605"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-27","epss":0.00702,"percentile":0.53064}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-27","epss":0.00702,"percentile":0.53064}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-27","epss":0.00702,"percentile":0.53064}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-27","epss":0.00702,"percentile":0.53064}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75143","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-27","epss":0.00702,"percentile":0.53064}],"risk":0.35100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75143"},"relatedVulnerabilities":[{"id":"CVE-2026-75143","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75143","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75143","date":"2026-10-27","epss":0.00702,"percentile":0.53064}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1c10bcc2e17255dacb717a25ab3db142ce390602","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24089","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-rist-protocol-reader"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75143","description":"FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, overflowing it when the payload exceeds the destination size. This is reachable via the async:rist:// URL scheme, where the async wrapper supplies a smaller buffer than the received payload. A remote RIST sender can trigger the overflow by sending a packet whose payload exceeds the caller buffer size."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-27","epss":0.00683,"percentile":0.52333}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-27","epss":0.00683,"percentile":0.52333}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-27","epss":0.00683,"percentile":0.52333}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-27","epss":0.00683,"percentile":0.52333}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-27","epss":0.00683,"percentile":0.52333}],"risk":0.3415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35367"},"relatedVulnerabilities":[{"id":"CVE-2024-35367","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35367","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35367","date":"2026-10-27","epss":0.00683,"percentile":0.52333}],"urls":["https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53","https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35367","description":"FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-27","epss":0.00681,"percentile":0.5223}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-27","epss":0.00681,"percentile":0.5223}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-27","epss":0.00681,"percentile":0.5223}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-27","epss":0.00681,"percentile":0.5223}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-27","epss":0.00681,"percentile":0.5223}],"risk":0.3405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36619"},"relatedVulnerabilities":[{"id":"CVE-2024-36619","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36619","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36619","date":"2026-10-27","epss":0.00681,"percentile":0.5223}],"urls":["https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651","https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36619","description":"FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition."}]},{"artifact":{"id":"52bcf6f4517919c7","cpes":["cpe:2.3:a:x11vnc:x11vnc:0.9.16-10:*:*:*:*:*:*:*"],"name":"x11vnc","purl":"pkg:deb/ubuntu/x11vnc@0.9.16-10?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.9.16-10","language":"","licenses":["GPL-2","GPL-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/x11vnc/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/x11vnc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-29260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"x11vnc","version":"0.9.16-10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2020-29260","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-29260","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29260","date":"2026-10-27","epss":0.01131,"percentile":0.66247}],"risk":0.33930000000000005,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-29260"},"relatedVulnerabilities":[{"id":"CVE-2020-29260","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-29260","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-29260","date":"2026-10-27","epss":0.01131,"percentile":0.66247}],"urls":["https://github.com/LibVNC/libvncserver/commit/bef41f6ec4097a8ee094f90a1b34a708fbd757ec","https://lists.debian.org/debian-lts-announce/2022/09/msg00035.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-29260","description":"libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup()."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2176","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-10-27","epss":0.00674,"percentile":0.51934}],"risk":0.337,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2176"},"relatedVulnerabilities":[{"id":"CVE-2025-2176","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-10-27","epss":0.00674,"percentile":0.51934}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299205","https://vuldb.com/?id.299205","https://vuldb.com/?submit.512802"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2176","description":"A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2176","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-10-27","epss":0.00674,"percentile":0.51934}],"risk":0.337,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2176"},"relatedVulnerabilities":[{"id":"CVE-2025-2176","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2176","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2176","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2176","date":"2026-10-27","epss":0.00674,"percentile":0.51934}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299205","https://vuldb.com/?id.299205","https://vuldb.com/?submit.512802"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2176","description":"A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The identifier of the patch is ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-27","epss":0.00672,"percentile":0.51878}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-27","epss":0.00672,"percentile":0.51878}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-27","epss":0.00672,"percentile":0.51878}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-27","epss":0.00672,"percentile":0.51878}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-27","epss":0.00672,"percentile":0.51878}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-27","epss":0.00672,"percentile":0.51878}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"9c02489cc4237990","cpes":["cpe:2.3:a:libx264-164:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264-164:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264_164:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264_164:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264:libx264-164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*","cpe:2.3:a:libx264:libx264_164:2\\:0.164.3108\\+git31e19f9-1:*:*:*:*:*:*:*"],"name":"libx264-164","purl":"pkg:deb/ubuntu/libx264-164@2%3A0.164.3108%2Bgit31e19f9-1?arch=amd64&distro=ubuntu-24.04&upstream=x264","type":"deb","version":"2:0.164.3108+git31e19f9-1","language":"","licenses":["BSD-3-clause","Expat","GPL-2","GPL-2+","ISC","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx264-164/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libx264-164/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx264-164:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libx264-164:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"x264"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"x264","version":"2:0.164.3108+git31e19f9-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25467","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-27","epss":0.00672,"percentile":0.51878}],"risk":0.336,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25467"},"relatedVulnerabilities":[{"id":"CVE-2025-25467","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25467","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25467","date":"2026-10-27","epss":0.00672,"percentile":0.51878}],"urls":["https://code.videolan.org/videolan/x264/-/issues/75"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25467","description":"Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-27","epss":0.00671,"percentile":0.51827}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-27","epss":0.00671,"percentile":0.51827}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-27","epss":0.00671,"percentile":0.51827}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-27","epss":0.00671,"percentile":0.51827}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35365","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35365","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-27","epss":0.00671,"percentile":0.51827}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35365"},"relatedVulnerabilities":[{"id":"CVE-2024-35365","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35365","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35365","date":"2026-10-27","epss":0.00671,"percentile":0.51827}],"urls":["https://gist.github.com/1047524396/d7d4ea8055b75c4a9f9bbcff31d21423","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/fftools/ffmpeg_mux_init.c#L886","https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35365","description":"FFmpeg version n6.1.1 has a double-free vulnerability in the fftools/ffmpeg_mux_init.c component of FFmpeg, specifically within the new_stream_audio function."}]},{"artifact":{"id":"de4de504f4c55499","cpes":["cpe:2.3:a:libimlib2t64:libimlib2t64:1.12.1-1.1build2:*:*:*:*:*:*:*"],"name":"libimlib2t64","purl":"pkg:deb/ubuntu/libimlib2t64@1.12.1-1.1build2?arch=amd64&distro=ubuntu-24.04&upstream=imlib2","type":"deb","version":"1.12.1-1.1build2","language":"","licenses":["imlib2-license"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libimlib2t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libimlib2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libimlib2t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libimlib2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"imlib2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-25450","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"imlib2","version":"1.12.1-1.1build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-25450","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-25450","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25450","date":"2026-10-27","epss":0.00659,"percentile":0.51317}],"risk":0.3295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-25450"},"relatedVulnerabilities":[{"id":"CVE-2024-25450","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-25450","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-25450","date":"2026-10-27","epss":0.00659,"percentile":0.51317}],"urls":["https://git.enlightenment.org/old/legacy-imlib2/issues/20","https://github.com/derf/feh/issues/712"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-25450","description":"imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts()."}]},{"artifact":{"id":"03a1b62b39da5b54","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-1ubuntu5.24.04.1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/ubuntu/libsndfile1@1.2.2-1ubuntu5.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=libsndfile","type":"deb","version":"1.2.2-1ubuntu5.24.04.1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52194","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsndfile","version":"1.2.2-1ubuntu5.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52194","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52194","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52194","date":"2026-10-27","epss":0.00653,"percentile":0.51085}],"risk":0.3265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52194"},"relatedVulnerabilities":[{"id":"CVE-2025-52194","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52194","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52194","date":"2026-10-27","epss":0.00653,"percentile":0.51085}],"urls":["https://bushido-sec.com/index.php/2025/08/08/libsndfile-buffer-overflow/","https://github.com/libsndfile","https://github.com/libsndfile/libsndfile/issues/1082"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52194","description":"A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerability occurs in the ircam_read_header function at src/ircam.c:164 during sample rate processing, leading to memory corruption and potential code execution."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-10-27","epss":0.00648,"percentile":0.50842}],"risk":0.32399999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2177"},"relatedVulnerabilities":[{"id":"CVE-2025-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-10-27","epss":0.00648,"percentile":0.50842}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299206","https://vuldb.com/?id.299206","https://vuldb.com/?submit.512803"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2177","description":"A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-10-27","epss":0.00648,"percentile":0.50842}],"risk":0.32399999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2177"},"relatedVulnerabilities":[{"id":"CVE-2025-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2177","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2177","date":"2026-10-27","epss":0.00648,"percentile":0.50842}],"urls":["https://github.com/zapping-vbi/zvbi/commit/ca1672134b3e2962cd392212c73f44f8f4cb489f","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299206","https://vuldb.com/?id.299206","https://vuldb.com/?submit.512803"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2177","description":"A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The manipulation of the argument pat_len leads to integer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as ca1672134b3e2962cd392212c73f44f8f4cb489f. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-27","epss":0.00647,"percentile":0.50803}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-27","epss":0.00647,"percentile":0.50803}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-27","epss":0.00647,"percentile":0.50803}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-27","epss":0.00647,"percentile":0.50803}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-35366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-35366","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-27","epss":0.00647,"percentile":0.50803}],"risk":0.3235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-35366"},"relatedVulnerabilities":[{"id":"CVE-2024-35366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-35366","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-35366","date":"2026-10-27","epss":0.00647,"percentile":0.50803}],"urls":["https://gist.github.com/1047524396/1e72f170d58c2547ebd4db4cdf6cfabf","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/sbgdec.c#L389","https://github.com/ffmpeg/ffmpeg/commit/0bed22d597b78999151e3bde0768b7fe763fc2a6"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-35366","description":"FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-27","epss":0.00646,"percentile":0.50752}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-27","epss":0.00646,"percentile":0.50752}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-27","epss":0.00646,"percentile":0.50752}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-27","epss":0.00646,"percentile":0.50752}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64830","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64830","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-27","epss":0.00646,"percentile":0.50752}],"risk":0.32299999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64830"},"relatedVulnerabilities":[{"id":"CVE-2026-64830","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64830","cwe":"CWE-122","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64830","date":"2026-10-27","epss":0.00646,"percentile":0.50752}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/dbd495f066a85ba96b17433f4306582aa37c3951","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23657","https://www.vulncheck.com/advisories/ffmpeg-heap-buffer-overflow-via-vobsub-subtitle-demuxer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64830","description":"FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declaring more distinct stream IDs than the fixed-size array bounds in libavformat/mpeg.c. Attackers can craft a subtitle file with excessive distinct stream IDs to trigger unbounded writes beyond the vobsub->q[] array boundary via ff_subtitles_queue_insert(), potentially achieving arbitrary code execution in any application using FFmpeg's VobSub demuxer."}]},{"artifact":{"id":"1fe29ec161099bff","cpes":["cpe:2.3:a:wget:wget:1.21.4-1ubuntu4.5:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/ubuntu/wget@1.21.4-1ubuntu4.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.21.4-1ubuntu4.5","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-10524","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"wget","version":"1.21.4-1ubuntu4.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10524","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10524","cwe":"CWE-918","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-10524","date":"2026-10-27","epss":0.01071,"percentile":0.64686}],"risk":0.32130000000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10524"},"relatedVulnerabilities":[{"id":"CVE-2024-10524","cvss":[{"type":"Secondary","source":"reefs@jfrog.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":3.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10524","cwe":"CWE-918","type":"Secondary","source":"reefs@jfrog.com"}],"epss":[{"cve":"CVE-2024-10524","date":"2026-10-27","epss":0.01071,"percentile":0.64686}],"urls":["https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778","https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/","https://seclists.org/oss-sec/2024/q4/107","http://www.openwall.com/lists/oss-security/2024/11/18/6","https://security.netapp.com/advisory/ntap-20250321-0007/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10524","description":"Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":">=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6610","fix":{"state":"fixed","versions":["1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-27","epss":0.00425,"percentile":0.36626}],"risk":0.31875000000000003,"urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/835145","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."},"relatedVulnerabilities":[{"id":"CVE-2026-78660","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-27","epss":0.00425,"percentile":0.36626}],"urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."}]},{"artifact":{"id":"bdd817d23e512645","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-27","epss":0.0063,"percentile":0.49968}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-27","epss":0.0063,"percentile":0.49968}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6613","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6613","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-27","epss":0.00414,"percentile":0.35564}],"risk":0.31049999999999994,"urls":["https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847311","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.\n\nThe impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."},"relatedVulnerabilities":[{"id":"CVE-2026-94439","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-27","epss":0.00414,"percentile":0.35564}],"urls":["https://go.dev/cl/847311","https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-10-27","epss":0.0062,"percentile":0.49518}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2175"},"relatedVulnerabilities":[{"id":"CVE-2025-2175","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-10-27","epss":0.0062,"percentile":0.49518}],"urls":["https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299204","https://vuldb.com/?id.299204","https://vuldb.com/?submit.512801"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2175","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-10-27","epss":0.0062,"percentile":0.49518}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2175"},"relatedVulnerabilities":[{"id":"CVE-2025-2175","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2175","cwe":"CWE-189","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2175","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2175","date":"2026-10-27","epss":0.0062,"percentile":0.49518}],"urls":["https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299204","https://vuldb.com/?id.299204","https://vuldb.com/?submit.512801"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2175","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulation leads to integer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"46a4073e58199a00","cpes":["cpe:2.3:a:libzvbi-common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi-common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi_common:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi-common:0.2.42-2:*:*:*:*:*:*:*","cpe:2.3:a:libzvbi:libzvbi_common:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi-common","purl":"pkg:deb/ubuntu/libzvbi-common@0.2.42-2?arch=all&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi-common.list"}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-10-27","epss":0.00615,"percentile":0.49247}],"risk":0.3075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2173"},"relatedVulnerabilities":[{"id":"CVE-2025-2173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-10-27","epss":0.00615,"percentile":0.49247}],"urls":["https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299202","https://vuldb.com/?id.299202","https://vuldb.com/?submit.512798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2173","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"89a2db9523f9e35e","cpes":["cpe:2.3:a:libzvbi0t64:libzvbi0t64:0.2.42-2:*:*:*:*:*:*:*"],"name":"libzvbi0t64","purl":"pkg:deb/ubuntu/libzvbi0t64@0.2.42-2?arch=amd64&distro=ubuntu-24.04&upstream=zvbi","type":"deb","version":"0.2.42-2","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libzvbi0t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libzvbi0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libzvbi0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zvbi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-2173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zvbi","version":"0.2.42-2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-2173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-10-27","epss":0.00615,"percentile":0.49247}],"risk":0.3075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-2173"},"relatedVulnerabilities":[{"id":"CVE-2025-2173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-908","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-2173","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-2173","date":"2026-10-27","epss":0.00615,"percentile":0.49247}],"urls":["https://github.com/zapping-vbi/zvbi/commit/8def647eea27f7fd7ad33ff79c2d6d3e39948dce","https://github.com/zapping-vbi/zvbi/releases/tag/v0.2.44","https://github.com/zapping-vbi/zvbi/security/advisories/GHSA-g7cg-7gw9-v8cf","https://vuldb.com/?ctiid.299202","https://vuldb.com/?id.299202","https://vuldb.com/?submit.512798"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-2173","description":"A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv.c. The manipulation of the argument src_length leads to uninitialized pointer. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.2.44 is able to address this issue. The patch is identified as 8def647eea27f7fd7ad33ff79c2d6d3e39948dce. It is recommended to upgrade the affected component. The code maintainer was informed beforehand about the issues. She reacted very fast and highly professional."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0719","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0719","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0719","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-0719","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0719","date":"2026-10-27","epss":0.0061,"percentile":0.48985}],"risk":0.305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0719"},"relatedVulnerabilities":[{"id":"CVE-2026-0719","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0719","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-0719","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0719","date":"2026-10-27","epss":0.0061,"percentile":0.48985}],"urls":["https://access.redhat.com/errata/RHSA-2026:1948","https://access.redhat.com/errata/RHSA-2026:2005","https://access.redhat.com/errata/RHSA-2026:2006","https://access.redhat.com/errata/RHSA-2026:2007","https://access.redhat.com/errata/RHSA-2026:2008","https://access.redhat.com/errata/RHSA-2026:2049","https://access.redhat.com/errata/RHSA-2026:2182","https://access.redhat.com/errata/RHSA-2026:2214","https://access.redhat.com/errata/RHSA-2026:2215","https://access.redhat.com/errata/RHSA-2026:2216","https://access.redhat.com/errata/RHSA-2026:2396","https://access.redhat.com/errata/RHSA-2026:2402","https://access.redhat.com/errata/RHSA-2026:2512","https://access.redhat.com/errata/RHSA-2026:2513","https://access.redhat.com/errata/RHSA-2026:2514","https://access.redhat.com/errata/RHSA-2026:2528","https://access.redhat.com/errata/RHSA-2026:2529","https://access.redhat.com/errata/RHSA-2026:2628","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/security/cve/CVE-2026-0719","https://bugzilla.redhat.com/show_bug.cgi?id=2427906","https://gitlab.gnome.org/GNOME/libsoup/-/issues/477","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0719.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0719","description":"A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0719","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0719","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0719","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-0719","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0719","date":"2026-10-27","epss":0.0061,"percentile":0.48985}],"risk":0.305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0719"},"relatedVulnerabilities":[{"id":"CVE-2026-0719","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0719","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-0719","cwe":"CWE-121","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-0719","date":"2026-10-27","epss":0.0061,"percentile":0.48985}],"urls":["https://access.redhat.com/errata/RHSA-2026:1948","https://access.redhat.com/errata/RHSA-2026:2005","https://access.redhat.com/errata/RHSA-2026:2006","https://access.redhat.com/errata/RHSA-2026:2007","https://access.redhat.com/errata/RHSA-2026:2008","https://access.redhat.com/errata/RHSA-2026:2049","https://access.redhat.com/errata/RHSA-2026:2182","https://access.redhat.com/errata/RHSA-2026:2214","https://access.redhat.com/errata/RHSA-2026:2215","https://access.redhat.com/errata/RHSA-2026:2216","https://access.redhat.com/errata/RHSA-2026:2396","https://access.redhat.com/errata/RHSA-2026:2402","https://access.redhat.com/errata/RHSA-2026:2512","https://access.redhat.com/errata/RHSA-2026:2513","https://access.redhat.com/errata/RHSA-2026:2514","https://access.redhat.com/errata/RHSA-2026:2528","https://access.redhat.com/errata/RHSA-2026:2529","https://access.redhat.com/errata/RHSA-2026:2628","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/security/cve/CVE-2026-0719","https://bugzilla.redhat.com/show_bug.cgi?id=2427906","https://gitlab.gnome.org/GNOME/libsoup/-/issues/477","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0719.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0719","description":"A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network communication. When processing extremely long passwords, an internal size calculation can overflow due to improper use of signed integers. This results in incorrect memory allocation on the stack, followed by unsafe memory copying. As a result, applications using libsoup may crash unexpectedly, creating a denial-of-service risk."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-27","epss":0.00599,"percentile":0.48471}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-27","epss":0.00599,"percentile":0.48471}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-27","epss":0.00599,"percentile":0.48471}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-27","epss":0.00599,"percentile":0.48471}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1594","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-27","epss":0.00599,"percentile":0.48471}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1594"},"relatedVulnerabilities":[{"id":"CVE-2025-1594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1594","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-121","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2025-1594","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1594","date":"2026-10-27","epss":0.00599,"percentile":0.48471}],"urls":["https://ffmpeg.org/","https://trac.ffmpeg.org/attachment/ticket/11418/poc","https://trac.ffmpeg.org/ticket/11418#comment:3","https://vuldb.com/?ctiid.296589","https://vuldb.com/?id.296589","https://vuldb.com/?submit.496929"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1594","description":"A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."}]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-39329","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-27","epss":0.00588,"percentile":0.47922}],"risk":0.294,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-39329"},"relatedVulnerabilities":[{"id":"CVE-2023-39329","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39329","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39329","date":"2026-10-27","epss":0.00588,"percentile":0.47922}],"urls":["https://access.redhat.com/errata/RHSA-2026:4128","https://access.redhat.com/security/cve/CVE-2023-39329","https://bugzilla.redhat.com/show_bug.cgi?id=2295816","https://github.com/uclouvain/openjpeg/issues/1474"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39329","description":"A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service."}]},{"artifact":{"id":"12838fd0d4234cbd","cpes":["cpe:2.3:a:libpixman-1-0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1-0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1_0:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman-1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman_1:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman-1-0:0.42.2-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpixman:libpixman_1_0:0.42.2-1build1:*:*:*:*:*:*:*"],"name":"libpixman-1-0","purl":"pkg:deb/ubuntu/libpixman-1-0@0.42.2-1build1?arch=amd64&distro=ubuntu-24.04&upstream=pixman","type":"deb","version":"0.42.2-1build1","language":"","licenses":["sha256:1b3fb5690861e15ca4fd6640fd4def4b2576617942eec04b6fcb7d8bc6c4c9da"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpixman-1-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libpixman-1-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libpixman-1-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pixman"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-37769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pixman","version":"0.42.2-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-37769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-27","epss":0.00586,"percentile":0.4783}],"risk":0.293,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-37769"},"relatedVulnerabilities":[{"id":"CVE-2023-37769","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-37769","cwe":"CWE-369","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-37769","date":"2026-10-27","epss":0.00586,"percentile":0.4783}],"urls":["https://gitlab.freedesktop.org/pixman/pixman/-/issues/76"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37769","description":"stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-27","epss":0.00584,"percentile":0.47704}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-27","epss":0.00584,"percentile":0.47704}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-27","epss":0.00584,"percentile":0.47704}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-27","epss":0.00584,"percentile":0.47704}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-27","epss":0.00584,"percentile":0.47704}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36616"},"relatedVulnerabilities":[{"id":"CVE-2024-36616","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36616","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36616","date":"2026-10-27","epss":0.00584,"percentile":0.47704}],"urls":["https://gist.github.com/1047524396/ded3e1509d8296ec4a91817867d108e0","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/westwood_vqa.c#L265","https://github.com/ffmpeg/ffmpeg/commit/86f73277bf014e2ce36dd2594f1e0fb8b3bd6661"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36616","description":"An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-27","epss":0.0058,"percentile":0.47514}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-27","epss":0.0058,"percentile":0.47514}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-27","epss":0.0058,"percentile":0.47514}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-27","epss":0.0058,"percentile":0.47514}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90816","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-27","epss":0.0058,"percentile":0.47514}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90816"},"relatedVulnerabilities":[{"id":"CVE-2026-90816","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90816","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90816","date":"2026-10-27","epss":0.0058,"percentile":0.47514}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/64fafd63f0b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21492","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90816","https://vuldb.com/submit/922626","https://vuldb.com/vuln/403318","https://vuldb.com/vuln/403318/cti"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90816","description":"A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration results in denial of service. The attack is possible to be carried out remotely. Upgrading to version 8.1 and 9.0 is able to mitigate this issue. The patch is named 64fafd63f0b4. Upgrading the affected component is recommended."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-10-27","epss":0.00578,"percentile":0.47421}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-10-27","epss":0.00578,"percentile":0.47421}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-10-27","epss":0.00578,"percentile":0.47421}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-10-27","epss":0.00578,"percentile":0.47421}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-52290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-52290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-10-27","epss":0.00578,"percentile":0.47421}],"risk":0.28900000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-52290"},"relatedVulnerabilities":[{"id":"CVE-2025-52290","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-52290","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-52290","date":"2026-10-27","epss":0.00578,"percentile":0.47421}],"urls":["https://ffmpeg.org","https://infosec.exchange/@sigdevel/116733488628458667","http://www.openwall.com/lists/oss-security/2026/10/20/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-52290","description":"A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4775","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-27","epss":0.0057,"percentile":0.46983}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4775"},"relatedVulnerabilities":[{"id":"CVE-2026-4775","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-27","epss":0.0057,"percentile":0.46983}],"urls":["https://access.redhat.com/errata/RHSA-2026:12265","https://access.redhat.com/errata/RHSA-2026:12271","https://access.redhat.com/errata/RHSA-2026:14929","https://access.redhat.com/errata/RHSA-2026:16055","https://access.redhat.com/errata/RHSA-2026:19150","https://access.redhat.com/errata/RHSA-2026:19363","https://access.redhat.com/errata/RHSA-2026:19585","https://access.redhat.com/errata/RHSA-2026:19586","https://access.redhat.com/errata/RHSA-2026:19604","https://access.redhat.com/errata/RHSA-2026:19608","https://access.redhat.com/errata/RHSA-2026:19609","https://access.redhat.com/errata/RHSA-2026:19657","https://access.redhat.com/errata/RHSA-2026:19659","https://access.redhat.com/errata/RHSA-2026:19702","https://access.redhat.com/errata/RHSA-2026:20583","https://access.redhat.com/errata/RHSA-2026:20585","https://access.redhat.com/errata/RHSA-2026:20591","https://access.redhat.com/errata/RHSA-2026:20592","https://access.redhat.com/errata/RHSA-2026:24992","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25910","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30349","https://access.redhat.com/errata/RHSA-2026:33388","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-4775","https://bugzilla.redhat.com/show_bug.cgi?id=2450768","https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4775","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14523","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14523","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14523","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-14523","date":"2026-10-27","epss":0.00544,"percentile":0.45451}],"risk":0.272,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14523"},"relatedVulnerabilities":[{"id":"CVE-2025-14523","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14523","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-14523","date":"2026-10-27","epss":0.00544,"percentile":0.45451}],"urls":["https://access.redhat.com/errata/RHSA-2026:0421","https://access.redhat.com/errata/RHSA-2026:0422","https://access.redhat.com/errata/RHSA-2026:0423","https://access.redhat.com/errata/RHSA-2026:0836","https://access.redhat.com/errata/RHSA-2026:0867","https://access.redhat.com/errata/RHSA-2026:0868","https://access.redhat.com/errata/RHSA-2026:0905","https://access.redhat.com/errata/RHSA-2026:0906","https://access.redhat.com/errata/RHSA-2026:0907","https://access.redhat.com/errata/RHSA-2026:0908","https://access.redhat.com/errata/RHSA-2026:0909","https://access.redhat.com/errata/RHSA-2026:0911","https://access.redhat.com/errata/RHSA-2026:0925","https://access.redhat.com/errata/RHSA-2026:1509","https://access.redhat.com/errata/RHSA-2026:1569","https://access.redhat.com/errata/RHSA-2026:1570","https://access.redhat.com/errata/RHSA-2026:1571","https://access.redhat.com/errata/RHSA-2026:1572","https://access.redhat.com/security/cve/CVE-2025-14523","https://bugzilla.redhat.com/show_bug.cgi?id=2421349","https://gitlab.gnome.org/GNOME/libsoup/-/issues/472"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14523","description":"A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14523","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14523","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14523","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-14523","date":"2026-10-27","epss":0.00544,"percentile":0.45451}],"risk":0.272,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14523"},"relatedVulnerabilities":[{"id":"CVE-2025-14523","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14523","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-14523","date":"2026-10-27","epss":0.00544,"percentile":0.45451}],"urls":["https://access.redhat.com/errata/RHSA-2026:0421","https://access.redhat.com/errata/RHSA-2026:0422","https://access.redhat.com/errata/RHSA-2026:0423","https://access.redhat.com/errata/RHSA-2026:0836","https://access.redhat.com/errata/RHSA-2026:0867","https://access.redhat.com/errata/RHSA-2026:0868","https://access.redhat.com/errata/RHSA-2026:0905","https://access.redhat.com/errata/RHSA-2026:0906","https://access.redhat.com/errata/RHSA-2026:0907","https://access.redhat.com/errata/RHSA-2026:0908","https://access.redhat.com/errata/RHSA-2026:0909","https://access.redhat.com/errata/RHSA-2026:0911","https://access.redhat.com/errata/RHSA-2026:0925","https://access.redhat.com/errata/RHSA-2026:1509","https://access.redhat.com/errata/RHSA-2026:1569","https://access.redhat.com/errata/RHSA-2026:1570","https://access.redhat.com/errata/RHSA-2026:1571","https://access.redhat.com/errata/RHSA-2026:1572","https://access.redhat.com/security/cve/CVE-2025-14523","https://bugzilla.redhat.com/show_bug.cgi?id=2421349","https://gitlab.gnome.org/GNOME/libsoup/-/issues/472"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14523","description":"A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the backend interprets it as destined for another host. This discrepancy enables request-smuggling style attacks, cache poisoning, or bypassing host-based access controls when an attacker supplies duplicate Host headers."}]},{"artifact":{"id":"e8ef03973c3f3fa5","cpes":["cpe:2.3:a:libgstreamer-plugins-base1.0-0:libgstreamer-plugins-base1.0-0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer-plugins-base1.0-0:libgstreamer_plugins_base1.0_0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer_plugins_base1.0_0:libgstreamer-plugins-base1.0-0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer_plugins_base1.0_0:libgstreamer_plugins_base1.0_0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer-plugins-base1.0:libgstreamer-plugins-base1.0-0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer-plugins-base1.0:libgstreamer_plugins_base1.0_0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer_plugins_base1.0:libgstreamer-plugins-base1.0-0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer_plugins_base1.0:libgstreamer_plugins_base1.0_0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer-plugins:libgstreamer-plugins-base1.0-0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer-plugins:libgstreamer_plugins_base1.0_0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer_plugins:libgstreamer-plugins-base1.0-0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer_plugins:libgstreamer_plugins_base1.0_0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer:libgstreamer-plugins-base1.0-0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libgstreamer:libgstreamer_plugins_base1.0_0:1.24.2-1ubuntu0.5:*:*:*:*:*:*:*"],"name":"libgstreamer-plugins-base1.0-0","purl":"pkg:deb/ubuntu/libgstreamer-plugins-base1.0-0@1.24.2-1ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=gst-plugins-base1.0","type":"deb","version":"1.24.2-1ubuntu0.5","language":"","licenses":["BSD","GPL-2+","LGPL","LGPL-2+","MIT/X11"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgstreamer-plugins-base1.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libgstreamer-plugins-base1.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgstreamer-plugins-base1.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libgstreamer-plugins-base1.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gst-plugins-base1.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85150","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gst-plugins-base1.0","version":"1.24.2-1ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-85150","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85150","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85150","date":"2026-10-27","epss":0.0053,"percentile":0.44655}],"risk":0.265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85150"},"relatedVulnerabilities":[{"id":"CVE-2026-85150","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85150","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85150","date":"2026-10-27","epss":0.0053,"percentile":0.44655}],"urls":["https://access.redhat.com/errata/RHSA-2026:66460","https://access.redhat.com/errata/RHSA-2026:67145","https://access.redhat.com/errata/RHSA-2026:69100","https://access.redhat.com/security/cve/CVE-2026-85150","https://bugzilla.redhat.com/show_bug.cgi?id=2527936","https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/120","https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/main/subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspmessage.c#L1408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85150","description":"A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-27","epss":0.00524,"percentile":0.44241}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-27","epss":0.00524,"percentile":0.44241}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-27","epss":0.00524,"percentile":0.44241}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-27","epss":0.00524,"percentile":0.44241}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-27","epss":0.00524,"percentile":0.44241}],"risk":0.262,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30754"},"relatedVulnerabilities":[{"id":"CVE-2026-30754","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30754","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30754","date":"2026-10-27","epss":0.00524,"percentile":0.44241}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20746","https://gist.github.com/momo-trip/4cddf2c9e15600873de55259dac6b0e6","https://github.com/momo-trip/poc_ffmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30754","description":"A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-27","epss":0.00521,"percentile":0.44035}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-27","epss":0.00521,"percentile":0.44035}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-27","epss":0.00521,"percentile":0.44035}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-27","epss":0.00521,"percentile":0.44035}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-27","epss":0.00521,"percentile":0.44035}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-27","epss":0.00521,"percentile":0.44035}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-27","epss":0.00521,"percentile":0.44035}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-27","epss":0.00521,"percentile":0.44035}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"ec7bc8c431630985","cpes":["cpe:2.3:a:libheif-plugin-aomdec:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin-aomdec:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_aomdec:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin_aomdec:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif-plugin:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif_plugin:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif-plugin-aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*","cpe:2.3:a:libheif:libheif_plugin_aomdec:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*"],"name":"libheif-plugin-aomdec","purl":"pkg:deb/ubuntu/libheif-plugin-aomdec@1.17.6-1ubuntu4.9?arch=amd64&distro=ubuntu-24.04&upstream=libheif","type":"deb","version":"1.17.6-1ubuntu4.9","language":"","licenses":["BOOST-1.0","BSD-3-clause","BSD-4-clause","GPL-3","GPL-3+","LGPL-3","LGPL-3+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif-plugin-aomdec/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libheif-plugin-aomdec/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif-plugin-aomdec:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libheif-plugin-aomdec:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libheif","version":"1.17.6-1ubuntu4.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-27","epss":0.00517,"percentile":0.43816}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84447"},"relatedVulnerabilities":[{"id":"CVE-2026-84447","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-27","epss":0.00517,"percentile":0.43816}],"urls":["https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."}]},{"artifact":{"id":"fe8b2702206cdb90","cpes":["cpe:2.3:a:libheif1:libheif1:1.17.6-1ubuntu4.9:*:*:*:*:*:*:*"],"name":"libheif1","purl":"pkg:deb/ubuntu/libheif1@1.17.6-1ubuntu4.9?arch=amd64&distro=ubuntu-24.04&upstream=libheif","type":"deb","version":"1.17.6-1ubuntu4.9","language":"","licenses":["BOOST-1.0","BSD-3-clause","BSD-4-clause","GPL-3","GPL-3+","LGPL-3","LGPL-3+","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheif1/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libheif1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheif1:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libheif1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libheif"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libheif","version":"1.17.6-1ubuntu4.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-27","epss":0.00517,"percentile":0.43816}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84447"},"relatedVulnerabilities":[{"id":"CVE-2026-84447","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84447","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84447","date":"2026-10-27","epss":0.00517,"percentile":0.43816}],"urls":["https://github.com/strukturag/libheif/commit/30b52a4e829efe0ee6d7208e8500b99f664af5e9","https://github.com/strukturag/libheif/releases/tag/v1.23.2","https://github.com/strukturag/libheif/security/advisories/GHSA-x8xm-cm2c-cfc8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84447","description":"libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processed_ids is copied per branch and ImageItem::decode_image() has no shared operation budget. This vulnerability is fixed in 1.23.2."}]},{"artifact":{"id":"6e2da3002b8f8400","cpes":["cpe:2.3:a:com.google.guava:guava:33.6.0-android:*:*:*:*:*:*:*","cpe:2.3:a:google:guava:33.6.0-android:*:*:*:*:*:*:*","cpe:2.3:a:guava:guava:33.6.0-android:*:*:*:*:*:*:*"],"name":"guava","purl":"pkg:maven/com.google.guava/guava@33.6.0-android","type":"java-archive","version":"33.6.0-android","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.google.guava","virtualPath":"/external_jars/https/repo1.maven.org/maven2/com/google/guava/guava/33.6.0-android/guava-33.6.0-android.jar","manifestName":"","pomArtifactID":"guava","archiveDigests":[{"value":"374ff93f90751e8fc6c7cb5046bab9b14ff69c92","algorithm":"sha1"}]},"locations":[{"path":"/external_jars/https/repo1.maven.org/maven2/com/google/guava/guava/33.6.0-android/guava-33.6.0-android.jar","layerID":"sha256:7ed31f0c7cf62fbb54bb89a307fd64b67d995c682765ecec4e9645cdb5751c43","accessPath":"/external_jars/https/repo1.maven.org/maven2/com/google/guava/guava/33.6.0-android/guava-33.6.0-android.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"33.7.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xxph-c9ww-hj94","versionConstraint":">=4.0,<=33.7.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.google.guava:guava","version":"33.6.0-android"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xxph-c9ww-hj94","fix":{"state":"fixed","versions":["33.7.2"],"available":[{"date":"2026-10-27","kind":"first-observed","version":"33.7.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102554","cwe":"CWE-502","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-102554","cwe":"CWE-770","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-102554","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"risk":0.25608000000000003,"urls":["https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94","https://nvd.nist.gov/vuln/detail/CVE-2026-102554","https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","https://github.com/google/guava/releases/tag/v33.7.2"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xxph-c9ww-hj94","description":"Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation"},"relatedVulnerabilities":[{"id":"CVE-2026-102554","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102554","cwe":"CWE-502","type":"Secondary","source":"cve-coordination@google.com"},{"cve":"CVE-2026-102554","cwe":"CWE-770","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2026-102554","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"urls":["https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe","https://github.com/google/guava/releases/tag/v33.7.2","https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554","description":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-27","epss":0.00506,"percentile":0.43015}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-27","epss":0.00506,"percentile":0.43015}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-27","epss":0.00506,"percentile":0.43015}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-27","epss":0.00506,"percentile":0.43015}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6602","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6602","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-27","epss":0.00506,"percentile":0.43015}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6602"},"relatedVulnerabilities":[{"id":"CVE-2023-6602","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6602","cwe":"CWE-99","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-6602","date":"2026-10-27","epss":0.00506,"percentile":0.43015}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334338","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6602","description":"A flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists."}]},{"artifact":{"id":"03a1b62b39da5b54","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-1ubuntu5.24.04.1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/ubuntu/libsndfile1@1.2.2-1ubuntu5.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=libsndfile","type":"deb","version":"1.2.2-1ubuntu5.24.04.1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-37555","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsndfile","version":"1.2.2-1ubuntu5.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-37555","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-37555","date":"2026-10-27","epss":0.00504,"percentile":0.42907}],"risk":0.252,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-37555"},"relatedVulnerabilities":[{"id":"CVE-2026-37555","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-37555","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-37555","date":"2026-10-27","epss":0.00504,"percentile":0.42907}],"urls":["https://gist.github.com/sgInnora/a5f5c19e4bf6f4fb74fab7b0ef2bfcc1","https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151","https://github.com/libsndfile/libsndfile/issues/833","https://access.redhat.com/errata/RHSA-2026:19559","https://access.redhat.com/errata/RHSA-2026:19560","https://access.redhat.com/errata/RHSA-2026:19610","https://access.redhat.com/errata/RHSA-2026:23221","https://access.redhat.com/errata/RHSA-2026:23222","https://access.redhat.com/errata/RHSA-2026:23223","https://access.redhat.com/errata/RHSA-2026:25092","https://access.redhat.com/errata/RHSA-2026:25197","https://access.redhat.com/errata/RHSA-2026:25198","https://access.redhat.com/errata/RHSA-2026:25227","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/security/cve/CVE-2026-37555","https://bugzilla.redhat.com/show_bug.cgi?id=2463856","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37555.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-37555","description":"An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec. The AIFF code path (line 241) was fixed with (sf_count_t) cast, but the WAV code path (line 235) and close path (line 167) were not. When samplesperblock (int) * blocks (int) exceeds INT_MAX, the 32-bit multiplication overflows before being assigned to sf.frames (sf_count_t/int64). With samplesperblock=50000 and blocks=50000, the product 2500000000 overflows to -1794967296. This causes incorrect frame count leading to heap buffer overflow or denial of service. Both values come from the WAV file header and are attacker-controlled. This issue was discovered after an incomplete fix for CVE-2022-33065."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15712","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15712","date":"2026-10-27","epss":0.00498,"percentile":0.42471}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15712"},"relatedVulnerabilities":[{"id":"CVE-2026-15712","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15712","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15712","date":"2026-10-27","epss":0.00498,"percentile":0.42471}],"urls":["https://access.redhat.com/security/cve/CVE-2026-15712","https://bugzilla.redhat.com/show_bug.cgi?id=2499939","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15712","description":"A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the \"Additional Debug Data\" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15712","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15712","date":"2026-10-27","epss":0.00498,"percentile":0.42471}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15712"},"relatedVulnerabilities":[{"id":"CVE-2026-15712","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15712","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15712","date":"2026-10-27","epss":0.00498,"percentile":0.42471}],"urls":["https://access.redhat.com/security/cve/CVE-2026-15712","https://bugzilla.redhat.com/show_bug.cgi?id=2499939","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15712","description":"A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the \"Additional Debug Data\" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-27","epss":0.00496,"percentile":0.4237}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-27","epss":0.00496,"percentile":0.4237}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-27","epss":0.00496,"percentile":0.4237}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-27","epss":0.00496,"percentile":0.4237}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58049","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58049","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-27","epss":0.00496,"percentile":0.4237}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58049"},"relatedVulnerabilities":[{"id":"CVE-2026-58049","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-58049","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-58049","date":"2026-10-27","epss":0.00496,"percentile":0.4237}],"urls":["https://github.com/FFmpeg/FFmpeg/blob/master/libavcodec/rasc.c","https://github.com/bikini/exploitarium/tree/main/ffmpeg-rasc-dlta-calc-poc","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-rasc-decoder-decode-dlta","https://access.redhat.com/errata/RHSA-2026:43711","https://access.redhat.com/errata/RHSA-2026:51180","https://access.redhat.com/errata/RHSA-2026:52832","https://access.redhat.com/errata/RHSA-2026:52833","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61627","https://access.redhat.com/errata/RHSA-2026:61628","https://access.redhat.com/errata/RHSA-2026:61629","https://access.redhat.com/security/cve/CVE-2026-58049","https://bugzilla.redhat.com/show_bug.cgi?id=2493952","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58049.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58049","description":"FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-27","epss":0.00496,"percentile":0.42326}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-27","epss":0.00496,"percentile":0.42326}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-27","epss":0.00496,"percentile":0.42326}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-27","epss":0.00496,"percentile":0.42326}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64835","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64835","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-27","epss":0.00496,"percentile":0.42326}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64835"},"relatedVulnerabilities":[{"id":"CVE-2026-64835","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64835","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64835","date":"2026-10-27","epss":0.00496,"percentile":0.42326}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/1836ef96846937a6cc2443698a693104f5c0b21e","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23659","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-memory-access-in-adx-audio-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64835","description":"FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnerability in the ADX audio decoder within libavcodec/adxdec.c that allows attackers to trigger both out-of-bounds reads and writes by supplying a crafted ADX or AAX audio file with a mid-stream channel layout change. When AV_PKT_DATA_NEW_EXTRADATA side data is received mid-stream, the adx_decode_frame function re-parses the stream header but fails to update the internal channel state, causing subsequent decoding operations to access the prev[] state array using a stale channel count."}]},{"artifact":{"id":"b904160816bf0fae","cpes":["cpe:2.3:a:xserver-common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver-common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xserver-common","purl":"pkg:deb/ubuntu/xserver-common@2%3A21.1.12-1ubuntu1.8?arch=all&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xserver-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xserver-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34000","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34000","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34000","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-34000","date":"2026-10-27","epss":0.00489,"percentile":0.41869}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34000"},"relatedVulnerabilities":[{"id":"CVE-2026-34000","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34000","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-34000","date":"2026-10-27","epss":0.00489,"percentile":0.41869}],"urls":["https://access.redhat.com/errata/RHSA-2026:19342","https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-34000","https://bugzilla.redhat.com/show_bug.cgi?id=2451107"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34000","description":"A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server."}]},{"artifact":{"id":"b904160816bf0fae","cpes":["cpe:2.3:a:xserver-common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver-common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xserver-common","purl":"pkg:deb/ubuntu/xserver-common@2%3A21.1.12-1ubuntu1.8?arch=all&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xserver-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xserver-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34002","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34002","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34002","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-34002","date":"2026-10-27","epss":0.00489,"percentile":0.41869}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34002"},"relatedVulnerabilities":[{"id":"CVE-2026-34002","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34002","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-34002","date":"2026-10-27","epss":0.00489,"percentile":0.41869}],"urls":["https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-34002","https://bugzilla.redhat.com/show_bug.cgi?id=2451112"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34002","description":"A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service."}]},{"artifact":{"id":"670a92a0d828ff64","cpes":["cpe:2.3:a:xvfb:xvfb:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xvfb","purl":"pkg:deb/ubuntu/xvfb@2%3A21.1.12-1ubuntu1.8?arch=amd64&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xvfb/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xvfb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34000","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34000","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34000","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-34000","date":"2026-10-27","epss":0.00489,"percentile":0.41869}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34000"},"relatedVulnerabilities":[{"id":"CVE-2026-34000","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34000","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-34000","date":"2026-10-27","epss":0.00489,"percentile":0.41869}],"urls":["https://access.redhat.com/errata/RHSA-2026:19342","https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-34000","https://bugzilla.redhat.com/show_bug.cgi?id=2451107"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34000","description":"A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server."}]},{"artifact":{"id":"670a92a0d828ff64","cpes":["cpe:2.3:a:xvfb:xvfb:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xvfb","purl":"pkg:deb/ubuntu/xvfb@2%3A21.1.12-1ubuntu1.8?arch=amd64&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xvfb/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xvfb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34002","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34002","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34002","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-34002","date":"2026-10-27","epss":0.00489,"percentile":0.41869}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34002"},"relatedVulnerabilities":[{"id":"CVE-2026-34002","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34002","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-34002","date":"2026-10-27","epss":0.00489,"percentile":0.41869}],"urls":["https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-34002","https://bugzilla.redhat.com/show_bug.cgi?id=2451112"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34002","description":"A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2443","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2443","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2443","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2443","date":"2026-10-27","epss":0.00488,"percentile":0.41829}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2443"},"relatedVulnerabilities":[{"id":"CVE-2026-2443","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2443","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2443","date":"2026-10-27","epss":0.00488,"percentile":0.41829}],"urls":["https://access.redhat.com/security/cve/CVE-2026-2443","https://bugzilla.redhat.com/show_bug.cgi?id=2439671","https://gitlab.gnome.org/GNOME/libsoup/-/issues/487"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2443","description":"A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2443","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2443","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2443","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2443","date":"2026-10-27","epss":0.00488,"percentile":0.41829}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2443"},"relatedVulnerabilities":[{"id":"CVE-2026-2443","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2443","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2443","date":"2026-10-27","epss":0.00488,"percentile":0.41829}],"urls":["https://access.redhat.com/security/cve/CVE-2026-2443","https://bugzilla.redhat.com/show_bug.cgi?id=2439671","https://gitlab.gnome.org/GNOME/libsoup/-/issues/487"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2443","description":"A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1760","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-1760","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1760","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1760","date":"2026-10-27","epss":0.0048,"percentile":0.41224}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1760"},"relatedVulnerabilities":[{"id":"CVE-2026-1760","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1760","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1760","date":"2026-10-27","epss":0.0048,"percentile":0.41224}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1760","https://bugzilla.redhat.com/show_bug.cgi?id=2435951","https://gitlab.gnome.org/GNOME/libsoup/-/issues/475"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1760","description":"A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-1760","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-1760","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-1760","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1760","date":"2026-10-27","epss":0.0048,"percentile":0.41224}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-1760"},"relatedVulnerabilities":[{"id":"CVE-2026-1760","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1760","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-1760","date":"2026-10-27","epss":0.0048,"percentile":0.41224}],"urls":["https://access.redhat.com/security/cve/CVE-2026-1760","https://bugzilla.redhat.com/show_bug.cgi?id=2435951","https://gitlab.gnome.org/GNOME/libsoup/-/issues/475"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1760","description":"A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine Transfer-Encoding: chunked and Connection: keep-alive headers. A remote, unauthenticated client can exploit this by sending specially crafted requests, causing SoupServer to fail to close the connection as required by RFC 9112. This allows the attacker to smuggle additional requests over the persistent connection, leading to unintended request processing and potential denial-of-service (DoS) conditions."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47057","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47057","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47057","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47057","date":"2026-10-27","epss":0.0047,"percentile":0.40482}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47057"},"relatedVulnerabilities":[{"id":"CVE-2026-47057","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47057","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47057","date":"2026-10-27","epss":0.0047,"percentile":0.40482}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47057","description":"Vulnerability in Oracle Java SE (component: Scripting).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and  11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47057","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47057","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47057","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47057","date":"2026-10-27","epss":0.0047,"percentile":0.40482}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47057"},"relatedVulnerabilities":[{"id":"CVE-2026-47057","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47057","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47057","date":"2026-10-27","epss":0.0047,"percentile":0.40482}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47057","description":"Vulnerability in Oracle Java SE (component: Scripting).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and  11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"14cfe0f375d6d1af","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg-3.1ubuntu2.2:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=amd64&distro=ubuntu-24.04&upstream=zlib","type":"deb","version":"1:1.3.dfsg-3.1ubuntu2.2","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.3.dfsg-3.1ubuntu2.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1:1.3.dfsg-3.1ubuntu2.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zlib","version":"1:1.3.dfsg-3.1ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"fixed","versions":["1:1.3.dfsg-3.1ubuntu2.3"],"available":[{"date":"2026-10-22","kind":"advisory","version":"1:1.3.dfsg-3.1ubuntu2.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-27","epss":0.00469,"percentile":0.40386}],"risk":0.2345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-27","epss":0.00469,"percentile":0.40386}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-27","epss":0.00467,"percentile":0.40231}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-27","epss":0.00467,"percentile":0.40231}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-27","epss":0.00467,"percentile":0.40231}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-27","epss":0.00467,"percentile":0.40231}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-27","epss":0.00467,"percentile":0.40231}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107695"},"relatedVulnerabilities":[{"id":"CVE-2026-107695","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107695","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107695","date":"2026-10-27","epss":0.00467,"percentile":0.40231}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618","https://gist.github.com/OxBat/59574a2940092cda1b6e76bbf96f53d0","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L866","https://github.com/FFmpeg/FFmpeg/commit/0e6eef35517a","https://github.com/FFmpeg/FFmpeg/commit/a4ddaba8bb78","https://github.com/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-infinite-loop-via-self-referencing-playlist"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","description":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-27","epss":0.00466,"percentile":0.40126}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-27","epss":0.00466,"percentile":0.40126}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-27","epss":0.00466,"percentile":0.40126}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-27","epss":0.00466,"percentile":0.40126}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-27","epss":0.00466,"percentile":0.40126}],"risk":0.233,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6604"},"relatedVulnerabilities":[{"id":"CVE-2023-6604","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6604","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6604","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6604","date":"2026-10-27","epss":0.00466,"percentile":0.40126}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334337","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6604","description":"A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38344","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38344","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38344"},"relatedVulnerabilities":[{"id":"CVE-2026-38344","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38344","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38344","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21583"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38344","description":"A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38346","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38346"},"relatedVulnerabilities":[{"id":"CVE-2026-38346","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38346","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38346","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21584"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38346","description":"An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38348","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38348","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38348"},"relatedVulnerabilities":[{"id":"CVE-2026-38348","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38348","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38348","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21588"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38348","description":"An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38349","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38349","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38349"},"relatedVulnerabilities":[{"id":"CVE-2026-38349","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38349","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38349","date":"2026-10-27","epss":0.0046,"percentile":0.39689}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21592"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38349","description":"An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-27","epss":0.0046,"percentile":0.39688}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-27","epss":0.0046,"percentile":0.39688}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-27","epss":0.0046,"percentile":0.39688}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-27","epss":0.0046,"percentile":0.39688}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-27","epss":0.0046,"percentile":0.39688}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38350"},"relatedVulnerabilities":[{"id":"CVE-2026-38350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38350","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38350","date":"2026-10-27","epss":0.0046,"percentile":0.39688}],"urls":["https://trac.ffmpeg.org/ticket/11686"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38350","description":"An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-27","epss":0.00458,"percentile":0.39513}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-27","epss":0.00458,"percentile":0.39513}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-27","epss":0.00458,"percentile":0.39513}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-27","epss":0.00458,"percentile":0.39513}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38347","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38347","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-27","epss":0.00458,"percentile":0.39513}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38347"},"relatedVulnerabilities":[{"id":"CVE-2026-38347","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38347","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38347","date":"2026-10-27","epss":0.00458,"percentile":0.39513}],"urls":["https://trac.ffmpeg.org/ticket/11692"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38347","description":"A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2436","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2436","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2436","date":"2026-10-27","epss":0.00455,"percentile":0.39337}],"risk":0.2275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2436"},"relatedVulnerabilities":[{"id":"CVE-2026-2436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2436","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2436","date":"2026-10-27","epss":0.00455,"percentile":0.39337}],"urls":["https://access.redhat.com/security/cve/CVE-2026-2436","https://bugzilla.redhat.com/show_bug.cgi?id=2442909","https://gitlab.gnome.org/GNOME/libsoup/-/issues/501"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2436","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2436","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2436","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2436","date":"2026-10-27","epss":0.00455,"percentile":0.39337}],"risk":0.2275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2436"},"relatedVulnerabilities":[{"id":"CVE-2026-2436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2436","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2436","date":"2026-10-27","epss":0.00455,"percentile":0.39337}],"urls":["https://access.redhat.com/security/cve/CVE-2026-2436","https://bugzilla.redhat.com/show_bug.cgi?id=2442909","https://gitlab.gnome.org/GNOME/libsoup/-/issues/501"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2436","description":"A flaw was found in libsoup's SoupServer. A remote attacker could exploit a use-after-free vulnerability where the `soup_server_disconnect()` function frees connection objects prematurely, even if a TLS handshake is still pending. If the handshake completes after the connection object has been freed, a dangling pointer is accessed, leading to a server crash and a Denial of Service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-27","epss":0.00454,"percentile":0.39234}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-27","epss":0.00454,"percentile":0.39234}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-27","epss":0.00454,"percentile":0.39234}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-27","epss":0.00454,"percentile":0.39234}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-27","epss":0.00454,"percentile":0.39234}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12706"},"relatedVulnerabilities":[{"id":"CVE-2026-12706","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12706","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12706","date":"2026-10-27","epss":0.00454,"percentile":0.39234}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12706","https://bugzilla.redhat.com/show_bug.cgi?id=2490710","https://lists.ffmpeg.org/archives/list/ffmpeg-devel@ffmpeg.org/message/TTRIJZA7UL6KJTEDMMBGZPLLJERJ3EFX/","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177766314111.63.10674887811034989327@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12706","description":"A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (crash)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83357","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83357","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83357","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83357","date":"2026-10-27","epss":0.00452,"percentile":0.39061}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83357"},"relatedVulnerabilities":[{"id":"CVE-2026-83357","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83357","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83357","date":"2026-10-27","epss":0.00452,"percentile":0.39061}],"urls":["https://www.oracle.com/security-alerts/cspusep2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83357","description":"Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1;  Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM.  Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83357","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83357","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83357","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83357","date":"2026-10-27","epss":0.00452,"percentile":0.39061}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83357"},"relatedVulnerabilities":[{"id":"CVE-2026-83357","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83357","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83357","date":"2026-10-27","epss":0.00452,"percentile":0.39061}],"urls":["https://www.oracle.com/security-alerts/cspusep2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83357","description":"Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1;  Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM.  Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-27","epss":0.00452,"percentile":0.39054}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-27","epss":0.00452,"percentile":0.39054}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-27","epss":0.00452,"percentile":0.39054}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-27","epss":0.00452,"percentile":0.39054}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-27","epss":0.00452,"percentile":0.39054}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30999"},"relatedVulnerabilities":[{"id":"CVE-2026-30999","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30999","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30999","date":"2026-10-27","epss":0.00452,"percentile":0.39054}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30999-Memory-Leak-e0d88ac53e2e42c1b5ef9aa3497e27b6","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c","https://www.ffmpeg.org/download.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30999","description":"A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"52bcf6f4517919c7","cpes":["cpe:2.3:a:x11vnc:x11vnc:0.9.16-10:*:*:*:*:*:*:*"],"name":"x11vnc","purl":"pkg:deb/ubuntu/x11vnc@0.9.16-10?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.9.16-10","language":"","licenses":["GPL-2","GPL-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/x11vnc/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/x11vnc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-32853","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"x11vnc","version":"0.9.16-10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32853","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32853","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-32853","date":"2026-10-27","epss":0.00445,"percentile":0.38508}],"risk":0.2225,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32853"},"relatedVulnerabilities":[{"id":"CVE-2026-32853","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32853","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-32853","date":"2026-10-27","epss":0.00445,"percentile":0.38508}],"urls":["https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931","https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj","https://www.vulncheck.com/advisories/libvncserver-ultrazip-encoding-heap-out-of-bounds-read"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32853","description":"LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e) contain a heap out-of-bounds read vulnerability in the UltraZip encoding handler that allows a malicious VNC server to cause information disclosure or application crash. Attackers can exploit improper bounds checking in the HandleUltraZipBPP() function by manipulating subrectangle header counts to read beyond the allocated heap buffer."}]},{"artifact":{"id":"eb3e4a5365ae61d2","cpes":["cpe:2.3:a:cpp:cpp:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*"],"name":"cpp","purl":"pkg:deb/ubuntu/cpp@4%3A13.2.0-7ubuntu1?arch=amd64&distro=ubuntu-24.04&upstream=gcc-defaults%401.214ubuntu1","type":"deb","version":"4:13.2.0-7ubuntu1","language":"","licenses":["BSD-4-Clause","GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cpp-x86-64-linux-gnu/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/cpp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp.list","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.list"},{"path":"/var/lib/dpkg/info/cpp.postinst","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.postinst"},{"path":"/var/lib/dpkg/info/cpp.postrm","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.postrm"},{"path":"/var/lib/dpkg/info/cpp.preinst","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.preinst"},{"path":"/var/lib/dpkg/info/cpp.prerm","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.prerm"}],"upstreams":[{"name":"gcc-defaults","version":"1.214ubuntu1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-defaults","version":"1.214ubuntu1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-27","epss":0.00444,"percentile":0.38429}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-27","epss":0.00444,"percentile":0.38429}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"cbf15ec0f2ef7744","cpes":["cpe:2.3:a:cpp-x86-64-linux-gnu:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64-linux-gnu:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64_linux_gnu:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64_linux_gnu:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64-linux:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64-linux:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64_linux:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64_linux:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*"],"name":"cpp-x86-64-linux-gnu","purl":"pkg:deb/ubuntu/cpp-x86-64-linux-gnu@4%3A13.2.0-7ubuntu1?arch=amd64&distro=ubuntu-24.04&upstream=gcc-defaults%401.214ubuntu1","type":"deb","version":"4:13.2.0-7ubuntu1","language":"","licenses":["BSD-4-Clause","GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cpp-x86-64-linux-gnu/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/cpp-x86-64-linux-gnu/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-x86-64-linux-gnu.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp-x86-64-linux-gnu.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-x86-64-linux-gnu.list","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp-x86-64-linux-gnu.list"}],"upstreams":[{"name":"gcc-defaults","version":"1.214ubuntu1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-defaults","version":"1.214ubuntu1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-27","epss":0.00444,"percentile":0.38429}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-10-27","epss":0.00444,"percentile":0.38429}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-27","epss":0.00443,"percentile":0.38358}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-27","epss":0.00443,"percentile":0.38358}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-27","epss":0.00443,"percentile":0.38358}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-27","epss":0.00443,"percentile":0.38358}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9951","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-27","epss":0.00443,"percentile":0.38358}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9951"},"relatedVulnerabilities":[{"id":"CVE-2025-9951","cvss":[{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9951","cwe":"CWE-122","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-9951","date":"2026-10-27","epss":0.00443,"percentile":0.38358}],"urls":["https://github.com/google/security-research/security/advisories/GHSA-39q3-f8jq-v6mg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9951","description":"A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the channel definition cdef atom of JPEG2000."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91373","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91373","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91373","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91373","date":"2026-10-27","epss":0.00441,"percentile":0.38124}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91373"},"relatedVulnerabilities":[{"id":"CVE-2026-91373","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91373","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91373","date":"2026-10-27","epss":0.00441,"percentile":0.38124}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91373","description":"Vulnerability in Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91373","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91373","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91373","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91373","date":"2026-10-27","epss":0.00441,"percentile":0.38124}],"risk":0.2205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91373"},"relatedVulnerabilities":[{"id":"CVE-2026-91373","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91373","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91373","date":"2026-10-27","epss":0.00441,"percentile":0.38124}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91373","description":"Vulnerability in Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-4035","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4035","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4035","date":"2026-10-27","epss":0.00438,"percentile":0.37919}],"risk":0.219,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4035"},"relatedVulnerabilities":[{"id":"CVE-2025-4035","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4035","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4035","date":"2026-10-27","epss":0.00438,"percentile":0.37919}],"urls":["https://access.redhat.com/errata/RHSA-2025:8128","https://access.redhat.com/security/cve/CVE-2025-4035","https://bugzilla.redhat.com/show_bug.cgi?id=2362651","https://gitlab.gnome.org/GNOME/libsoup/-/issues/443","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/443"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4035","description":"A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-4035","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4035","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4035","date":"2026-10-27","epss":0.00438,"percentile":0.37919}],"risk":0.219,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4035"},"relatedVulnerabilities":[{"id":"CVE-2025-4035","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4035","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4035","date":"2026-10-27","epss":0.00438,"percentile":0.37919}],"urls":["https://access.redhat.com/errata/RHSA-2025:8128","https://access.redhat.com/security/cve/CVE-2025-4035","https://bugzilla.redhat.com/show_bug.cgi?id=2362651","https://gitlab.gnome.org/GNOME/libsoup/-/issues/443","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/443"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4035","description":"A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set cookies for domains it does not own, potentially leading to integrity issues such as session fixation."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-27","epss":0.00437,"percentile":0.37782}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-27","epss":0.00437,"percentile":0.37782}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-27","epss":0.00437,"percentile":0.37782}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-27","epss":0.00437,"percentile":0.37782}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6385","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-27","epss":0.00437,"percentile":0.37782}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6385"},"relatedVulnerabilities":[{"id":"CVE-2026-6385","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6385","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-6385","date":"2026-10-27","epss":0.00437,"percentile":0.37782}],"urls":["https://access.redhat.com/security/cve/CVE-2026-6385","https://bugzilla.redhat.com/show_bug.cgi?id=2458764"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6385","description":"A flaw was found in FFmpeg. A remote attacker could exploit this vulnerability by providing a specially crafted MPEG-PS/VOB media file containing a malicious DVD subtitle stream. This vulnerability is caused by a signed integer overflow in the DVD subtitle parser's fragment reassembly bounds checks, leading to a heap out-of-bounds write. Successful exploitation can result in a denial of service (DoS) due to an application crash, and potentially lead to arbitrary code execution."}]},{"artifact":{"id":"f2f9ea64412a82e3","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/ubuntu/libavahi-client3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-27","epss":0.00726,"percentile":0.5392}],"risk":0.2178,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52616"},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-27","epss":0.00726,"percentile":0.5392}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"e190b3f2d6ee823a","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/ubuntu/libavahi-common-data@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-27","epss":0.00726,"percentile":0.5392}],"risk":0.2178,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52616"},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-27","epss":0.00726,"percentile":0.5392}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"1439f27e2c1f750c","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/ubuntu/libavahi-common3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52616","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-27","epss":0.00726,"percentile":0.5392}],"risk":0.2178,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52616"},"relatedVulnerabilities":[{"id":"CVE-2024-52616","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52616","cwe":"CWE-334","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52616","date":"2026-10-27","epss":0.00726,"percentile":0.5392}],"urls":["https://access.redhat.com/errata/RHSA-2025:7437","https://access.redhat.com/security/cve/CVE-2024-52616","https://bugzilla.redhat.com/show_bug.cgi?id=2326429","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52616","description":"A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12912","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12912","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-27","epss":0.00433,"percentile":0.37378}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12912"},"relatedVulnerabilities":[{"id":"CVE-2026-12912","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-27","epss":0.00433,"percentile":0.37378}],"urls":["https://access.redhat.com/errata/RHSA-2026:34890","https://access.redhat.com/errata/RHSA-2026:41892","https://access.redhat.com/errata/RHSA-2026:42668","https://access.redhat.com/errata/RHSA-2026:47183","https://access.redhat.com/errata/RHSA-2026:47184","https://access.redhat.com/errata/RHSA-2026:49671","https://access.redhat.com/errata/RHSA-2026:50774","https://access.redhat.com/errata/RHSA-2026:54638","https://access.redhat.com/errata/RHSA-2026:54640","https://access.redhat.com/errata/RHSA-2026:54642","https://access.redhat.com/errata/RHSA-2026:58545","https://access.redhat.com/errata/RHSA-2026:58553","https://access.redhat.com/errata/RHSA-2026:58554","https://access.redhat.com/errata/RHSA-2026:58556","https://access.redhat.com/errata/RHSA-2026:61657","https://access.redhat.com/errata/RHSA-2026:69292","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:83550","https://access.redhat.com/security/cve/CVE-2026-12912","https://bugzilla.redhat.com/show_bug.cgi?id=2492871","https://gitlab.com/libtiff/libtiff/-/merge_requests/873","https://gitlab.com/libtiff/libtiff/-/work_items/824","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12912","description":"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2369","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2369","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2369","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2369","date":"2026-10-27","epss":0.00427,"percentile":0.36817}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2369"},"relatedVulnerabilities":[{"id":"CVE-2026-2369","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2369","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2369","date":"2026-10-27","epss":0.00427,"percentile":0.36817}],"urls":["https://access.redhat.com/security/cve/CVE-2026-2369","https://bugzilla.redhat.com/show_bug.cgi?id=2439091","https://gitlab.gnome.org/GNOME/libsoup/-/issues/498"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2369","description":"A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2369","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2369","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2369","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2369","date":"2026-10-27","epss":0.00427,"percentile":0.36817}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2369"},"relatedVulnerabilities":[{"id":"CVE-2026-2369","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2369","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2369","date":"2026-10-27","epss":0.00427,"percentile":0.36817}],"urls":["https://access.redhat.com/security/cve/CVE-2026-2369","https://bugzilla.redhat.com/show_bug.cgi?id=2439091","https://gitlab.gnome.org/GNOME/libsoup/-/issues/498"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2369","description":"A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-27","epss":0.00425,"percentile":0.36545}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-27","epss":0.00425,"percentile":0.36545}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61702","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61702","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-10-27","epss":0.00424,"percentile":0.36535}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61702"},"relatedVulnerabilities":[{"id":"CVE-2026-61702","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61702","cwe":"CWE-22","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-61702","date":"2026-10-27","epss":0.00424,"percentile":0.36535}],"urls":["https://github.com/OpenPrinting/cups/commit/08a8a277ce2a8948a1af33552247a1ac53b72df3","https://github.com/OpenPrinting/cups/commit/6650428234616a97d3298e0e2d4419c62c1339d2","https://github.com/OpenPrinting/cups/releases/tag/v2.4.20","https://github.com/OpenPrinting/cups/security/advisories/GHSA-gq9p-4w7m-2f5g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61702","description":"OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-27","epss":0.00424,"percentile":0.36521}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-27","epss":0.00424,"percentile":0.36521}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-27","epss":0.00424,"percentile":0.36521}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-27","epss":0.00424,"percentile":0.36521}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-27","epss":0.00424,"percentile":0.36521}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-27","epss":0.00424,"percentile":0.36521}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-27","epss":0.00424,"percentile":0.36521}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-27","epss":0.00424,"percentile":0.36521}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-27","epss":0.00422,"percentile":0.36365}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-27","epss":0.00422,"percentile":0.36365}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-27","epss":0.00422,"percentile":0.36365}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-27","epss":0.00422,"percentile":0.36365}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-90815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-90815","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-27","epss":0.00422,"percentile":0.36365}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-90815"},"relatedVulnerabilities":[{"id":"CVE-2026-90815","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-90815","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-90815","cwe":"CWE-125","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-90815","date":"2026-10-27","epss":0.00422,"percentile":0.36365}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/8970658472d1","https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21487","https://ffmpeg.org/","https://vuldb.com/cve/CVE-2026-90815","https://vuldb.com/submit/922609","https://vuldb.com/vuln/403317","https://vuldb.com/vuln/403317/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-90815","description":"A vulnerability has been found in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1. Affected by this issue is the function setup_3x3 of the file libavfilter/vf_convolution.c of the component Convolution Filter. Such manipulation leads to out-of-bounds read. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.4.7, 5.1.9, 6.1.5, 7.1.4, 8.0.2, 8.1.1 and 9.0 can resolve this issue. The name of the patch is 8970658472/e24b9820b4. It is suggested to upgrade the affected component."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-27","epss":0.00422,"percentile":0.36315}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-27","epss":0.00422,"percentile":0.36315}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-27","epss":0.00422,"percentile":0.36315}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-27","epss":0.00422,"percentile":0.36315}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22919","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-27","epss":0.00422,"percentile":0.36315}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22919"},"relatedVulnerabilities":[{"id":"CVE-2025-22919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22919","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22919","date":"2026-10-27","epss":0.00422,"percentile":0.36315}],"urls":["https://trac.ffmpeg.org/ticket/11385","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22919","description":"A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83408","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83408","date":"2026-10-27","epss":0.00421,"percentile":0.36235}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83408"},"relatedVulnerabilities":[{"id":"CVE-2026-83408","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83408","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83408","date":"2026-10-27","epss":0.00421,"percentile":0.36235}],"urls":["https://www.oracle.com/security-alerts/cspusep2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83408","description":"Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1;  Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM.  Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83408","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83408","date":"2026-10-27","epss":0.00421,"percentile":0.36235}],"risk":0.21050000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83408"},"relatedVulnerabilities":[{"id":"CVE-2026-83408","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83408","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83408","date":"2026-10-27","epss":0.00421,"percentile":0.36235}],"urls":["https://www.oracle.com/security-alerts/cspusep2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83408","description":"Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1;  Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM.  Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91394","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91394","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91394","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91394","date":"2026-10-27","epss":0.00419,"percentile":0.36038}],"risk":0.20950000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91394"},"relatedVulnerabilities":[{"id":"CVE-2026-91394","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91394","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91394","date":"2026-10-27","epss":0.00419,"percentile":0.36038}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91394","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91394","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91394","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91394","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91394","date":"2026-10-27","epss":0.00419,"percentile":0.36038}],"risk":0.20950000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91394"},"relatedVulnerabilities":[{"id":"CVE-2026-91394","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91394","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91394","date":"2026-10-27","epss":0.00419,"percentile":0.36038}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91394","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102560","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102560","date":"2026-10-27","epss":0.00419,"percentile":0.36034}],"risk":0.20950000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102560"},"relatedVulnerabilities":[{"id":"CVE-2026-102560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102560","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102560","date":"2026-10-27","epss":0.00419,"percentile":0.36034}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/security/cve/CVE-2026-102560","https://bugzilla.redhat.com/show_bug.cgi?id=2543296"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102560","description":"A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102560","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102560","date":"2026-10-27","epss":0.00419,"percentile":0.36034}],"risk":0.20950000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102560"},"relatedVulnerabilities":[{"id":"CVE-2026-102560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102560","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102560","date":"2026-10-27","epss":0.00419,"percentile":0.36034}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/security/cve/CVE-2026-102560","https://bugzilla.redhat.com/show_bug.cgi?id=2543296"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102560","description":"A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-27","epss":0.00416,"percentile":0.35718}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-27","epss":0.00416,"percentile":0.35718}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-27","epss":0.00416,"percentile":0.35718}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-27","epss":0.00416,"percentile":0.35718}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6601","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6601","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-27","epss":0.00416,"percentile":0.35718}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6601"},"relatedVulnerabilities":[{"id":"CVE-2023-6601","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6601","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"},{"cve":"CVE-2023-6601","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-6601","date":"2026-10-27","epss":0.00416,"percentile":0.35718}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2253172","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6601","description":"A flaw was found in FFmpeg's HLS demuxer. This vulnerability allows bypassing unsafe file extension checks and triggering arbitrary demuxers via base64-encoded data URIs appended with specific file extensions."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-27","epss":0.00416,"percentile":0.35698}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-27","epss":0.00416,"percentile":0.35698}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-27","epss":0.00416,"percentile":0.35698}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-27","epss":0.00416,"percentile":0.35698}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-25473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-25473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-27","epss":0.00416,"percentile":0.35698}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-25473"},"relatedVulnerabilities":[{"id":"CVE-2025-25473","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-25473","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-25473","date":"2026-10-27","epss":0.00416,"percentile":0.35698}],"urls":["https://git.ffmpeg.org/gitweb/ffmpeg.git/blobdiff/4f3c9f2f03378a08692a26532bc3146414717f8c..c08d300481b8ebb846cd43a473988fdbc6793d1b:/libavformat/avformat.c","https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c08d300481b8ebb846cd43a473988fdbc6793d1b","https://trac.ffmpeg.org/ticket/11419"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-25473","description":"FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c."}]},{"artifact":{"id":"7d0f7a9515ec6de4","cpes":["cpe:2.3:a:xdg-utils:xdg-utils:1.1.3-4.1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:xdg-utils:xdg_utils:1.1.3-4.1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg-utils:1.1.3-4.1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:xdg_utils:xdg_utils:1.1.3-4.1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg-utils:1.1.3-4.1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:xdg:xdg_utils:1.1.3-4.1ubuntu3:*:*:*:*:*:*:*"],"name":"xdg-utils","purl":"pkg:deb/ubuntu/xdg-utils@1.1.3-4.1ubuntu3?arch=all&distro=ubuntu-24.04","type":"deb","version":"1.1.3-4.1ubuntu3","language":"","licenses":["Expat"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xdg-utils/copyright","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/usr/share/doc/xdg-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.md5sums","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/info/xdg-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xdg-utils.list","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/info/xdg-utils.list"},{"path":"/var/lib/dpkg/info/xdg-utils.postinst","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/info/xdg-utils.postinst"},{"path":"/var/lib/dpkg/info/xdg-utils.prerm","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/info/xdg-utils.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-4055","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xdg-utils","version":"1.1.3-4.1ubuntu3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2022-4055","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4055","cwe":"CWE-146","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2022-4055","date":"2026-10-27","epss":0.00692,"percentile":0.52675}],"risk":0.20759999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4055"},"relatedVulnerabilities":[{"id":"CVE-2022-4055","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4055","cwe":"CWE-146","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2022-4055","date":"2026-10-27","epss":0.00692,"percentile":0.52675}],"urls":["https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/205#note_1494267"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4055","description":"When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked."}]},{"artifact":{"id":"f7eca80653a08715","cpes":["cpe:2.3:a:libjxl0.7:libjxl0.7:0.7.0-10.2ubuntu6.1:*:*:*:*:*:*:*"],"name":"libjxl0.7","purl":"pkg:deb/ubuntu/libjxl0.7@0.7.0-10.2ubuntu6.1?arch=amd64&distro=ubuntu-24.04&upstream=jpeg-xl","type":"deb","version":"0.7.0-10.2ubuntu6.1","language":"","licenses":["BSD-3-clause-Google","ISC-License"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjxl0.7/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libjxl0.7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjxl0.7:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libjxl0.7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"jpeg-xl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"jpeg-xl","version":"0.7.0-10.2ubuntu6.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82522","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82522","cwe":"CWE-681","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82522","date":"2026-10-27","epss":0.00407,"percentile":0.34817}],"risk":0.2035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82522"},"relatedVulnerabilities":[{"id":"CVE-2026-82522","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82522","cwe":"CWE-681","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-82522","date":"2026-10-27","epss":0.00407,"percentile":0.34817}],"urls":["https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68","https://github.com/libjxl/libjxl/pull/4885","https://github.com/libjxl/libjxl/releases/tag/v0.12.0","https://www.vulncheck.com/advisories/libjxl-container-box-parser-integer-underflow-via-32-bit-size-truncation"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82522","description":"libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary metadata by exploiting 64-bit box size truncation to size_t on 32-bit platforms. Attackers can supply a crafted JPEG XL file causing the decoder to parse attacker-controlled codestream bytes as phantom box headers, enabling injection of arbitrary metadata (Exif, XMP, IPTC, JUMBF) and potential out-of-bounds reads."}]},{"artifact":{"id":"0bf934ad0e4dae4b","cpes":["cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0-0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0_0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf-2.0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf_2.0:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf-2.0-0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf_2.0_0:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf-2.0-0","purl":"pkg:deb/ubuntu/libgdk-pixbuf-2.0-0@2.42.10%2Bdfsg-3ubuntu3.3?arch=amd64&distro=ubuntu-24.04&upstream=gdk-pixbuf","type":"deb","version":"2.42.10+dfsg-3ubuntu3.3","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libgdk-pixbuf-2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf-2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gdk-pixbuf","version":"2.42.10+dfsg-3ubuntu3.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-10-27","epss":0.00405,"percentile":0.34623}],"risk":0.20249999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16768"},"relatedVulnerabilities":[{"id":"CVE-2026-16768","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-10-27","epss":0.00405,"percentile":0.34623}],"urls":["https://access.redhat.com/security/cve/CVE-2026-16768","https://bugzilla.redhat.com/show_bug.cgi?id=2506437","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."}]},{"artifact":{"id":"b28b3a9e124727ef","cpes":["cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0-common:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0_common:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk-pixbuf2.0:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk_pixbuf2.0:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk-pixbuf2.0-common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*","cpe:2.3:a:libgdk:libgdk_pixbuf2.0_common:2.42.10\\+dfsg-3ubuntu3.3:*:*:*:*:*:*:*"],"name":"libgdk-pixbuf2.0-common","purl":"pkg:deb/ubuntu/libgdk-pixbuf2.0-common@2.42.10%2Bdfsg-3ubuntu3.3?arch=all&distro=ubuntu-24.04&upstream=gdk-pixbuf","type":"deb","version":"2.42.10+dfsg-3ubuntu3.3","language":"","licenses":["CC0-1.0","GPL-2","GPL-2+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libgdk-pixbuf2.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libgdk-pixbuf2.0-common.list"}],"upstreams":[{"name":"gdk-pixbuf"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gdk-pixbuf","version":"2.42.10+dfsg-3ubuntu3.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-10-27","epss":0.00405,"percentile":0.34623}],"risk":0.20249999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16768"},"relatedVulnerabilities":[{"id":"CVE-2026-16768","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16768","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-16768","date":"2026-10-27","epss":0.00405,"percentile":0.34623}],"urls":["https://access.redhat.com/security/cve/CVE-2026-16768","https://bugzilla.redhat.com/show_bug.cgi?id=2506437","https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/302"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16768","description":"A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occur due to improper bounds checking against the actual palette size. This vulnerability causes heap bytes to be interpreted as valid palette indices and rendered as RGB pixel values in the output image, allowing an attacker to extract heap content via the generated output, such as a thumbnail."}]},{"artifact":{"id":"52bcf6f4517919c7","cpes":["cpe:2.3:a:x11vnc:x11vnc:0.9.16-10:*:*:*:*:*:*:*"],"name":"x11vnc","purl":"pkg:deb/ubuntu/x11vnc@0.9.16-10?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.9.16-10","language":"","licenses":["GPL-2","GPL-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/x11vnc/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/x11vnc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-50538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"x11vnc","version":"0.9.16-10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-50538","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-50538","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50538","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50538","date":"2026-10-27","epss":0.00404,"percentile":0.3444}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-50538"},"relatedVulnerabilities":[{"id":"CVE-2026-50538","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50538","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50538","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50538","date":"2026-10-27","epss":0.00404,"percentile":0.3444}],"urls":["https://github.com/LibVNC/libvncserver/commit/540332be3e0acc566fa64da6f1b4680c72c724dd","https://github.com/LibVNC/libvncserver/security/advisories/GHSA-v9pm-47h4-jcq8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50538","description":"LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker\nis the server), works in a default build with default settings, and fires from a single `FramebufferUpdate` the moment the victim connects. It crashes any client unconditionally (denial of service); we also demonstrated it overwriting an application callback pointer and redirecting execution to attacker-chosen code (code execution) under the default configuration. Commit 540332be3e0acc566fa64da6f1b4680c72c724dd patches the issue."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102559","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102559","date":"2026-10-27","epss":0.00404,"percentile":0.34438}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102559"},"relatedVulnerabilities":[{"id":"CVE-2026-102559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102559","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102559","date":"2026-10-27","epss":0.00404,"percentile":0.34438}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/errata/RHSA-2026:84586","https://access.redhat.com/security/cve/CVE-2026-102559","https://bugzilla.redhat.com/show_bug.cgi?id=2543285"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102559","description":"A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102559","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102559","date":"2026-10-27","epss":0.00404,"percentile":0.34438}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102559"},"relatedVulnerabilities":[{"id":"CVE-2026-102559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102559","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102559","date":"2026-10-27","epss":0.00404,"percentile":0.34438}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/errata/RHSA-2026:84586","https://access.redhat.com/security/cve/CVE-2026-102559","https://bugzilla.redhat.com/show_bug.cgi?id=2543285"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102559","description":"A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-27","epss":0.00403,"percentile":0.34409}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93990"},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-27","epss":0.00403,"percentile":0.34409}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91418","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91418","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91418","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91418","date":"2026-10-27","epss":0.00403,"percentile":0.34342}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91418"},"relatedVulnerabilities":[{"id":"CVE-2026-91418","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91418","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91418","date":"2026-10-27","epss":0.00403,"percentile":0.34342}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91418","description":"Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle JavaFX: 21.0.12, 25.0.4, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91418","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91418","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91418","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91418","date":"2026-10-27","epss":0.00403,"percentile":0.34342}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91418"},"relatedVulnerabilities":[{"id":"CVE-2026-91418","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91418","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91418","date":"2026-10-27","epss":0.00403,"percentile":0.34342}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91418","description":"Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle JavaFX: 21.0.12, 25.0.4, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-27","epss":0.00401,"percentile":0.34146}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-27","epss":0.00401,"percentile":0.34146}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-27","epss":0.00401,"percentile":0.34146}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-27","epss":0.00401,"percentile":0.34146}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-27","epss":0.00401,"percentile":0.34146}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66036"},"relatedVulnerabilities":[{"id":"CVE-2026-66036","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66036","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66036","date":"2026-10-27","epss":0.00401,"percentile":0.34146}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/5d7112c60e6f0f0742ce47d448e6da0718a70f4c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23783","https://www.vulncheck.com/advisories/ffmpeg-heap-out-of-bounds-write-in-vf-hqdn3d-filter"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66036","description":"FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when filtergraph reinitialization is disabled via the -reinit_filter 0 option. Attackers can provide a malicious video input where vf_hqdn3d.config_input() allocates undersized per-plane line-history buffers based on the initial frame width, and subsequent larger frames cause denoise_spatial() to write beyond the allocation boundary, resulting in heap memory corruption."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-27","epss":0.004,"percentile":0.34035}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-27","epss":0.004,"percentile":0.34035}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-27","epss":0.004,"percentile":0.34035}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-27","epss":0.004,"percentile":0.34035}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30998","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-27","epss":0.004,"percentile":0.34035}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30998"},"relatedVulnerabilities":[{"id":"CVE-2026-30998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30998","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30998","date":"2026-10-27","epss":0.004,"percentile":0.34035}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30998-Resource-Leak-3265a71f9cca4dc58df4632ce8b60a50","https://ffmpeg.org/doxygen/7.0/zmqsend_8c_source.html","https://github.com/FFmpeg/FFmpeg/blob/master/tools/zmqsend.c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30998","description":"An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file."}]},{"artifact":{"id":"98f54f254c58862c","cpes":["cpe:2.3:a:libdw1t64:libdw1t64:0.190-1.1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdw1t64","purl":"pkg:deb/ubuntu/libdw1t64@0.190-1.1ubuntu0.1?arch=amd64&distro=ubuntu-24.04&upstream=elfutils","type":"deb","version":"0.190-1.1ubuntu0.1","language":"","licenses":["BSD-2-clause","GFDL-1.3","GFDL-NIV-1.3","GPL-2","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdw1t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libdw1t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdw1t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libdw1t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"elfutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1352","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"elfutils","version":"0.190-1.1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1352","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-27","epss":0.00665,"percentile":0.51583}],"risk":0.19949999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1352"},"relatedVulnerabilities":[{"id":"CVE-2025-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-27","epss":0.00665,"percentile":0.51583}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15923","https://sourceware.org/bugzilla/show_bug.cgi?id=32650","https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2","https://vuldb.com/?ctiid.295960","https://vuldb.com/?id.295960","https://vuldb.com/?submit.495965","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1352","description":"A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"84189c52cc07ec75","cpes":["cpe:2.3:a:libelf1t64:libelf1t64:0.190-1.1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libelf1t64","purl":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64&distro=ubuntu-24.04&upstream=elfutils","type":"deb","version":"0.190-1.1ubuntu0.1","language":"","licenses":["BSD-2-clause","GFDL-1.3","GFDL-NIV-1.3","GPL-2","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libelf1t64/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libelf1t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"elfutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1352","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"elfutils","version":"0.190-1.1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1352","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-27","epss":0.00665,"percentile":0.51583}],"risk":0.19949999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1352"},"relatedVulnerabilities":[{"id":"CVE-2025-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-27","epss":0.00665,"percentile":0.51583}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15923","https://sourceware.org/bugzilla/show_bug.cgi?id=32650","https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2","https://vuldb.com/?ctiid.295960","https://vuldb.com/?id.295960","https://vuldb.com/?submit.495965","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1352","description":"A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-27","epss":0.00396,"percentile":0.3367}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-27","epss":0.00396,"percentile":0.3367}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-27","epss":0.00396,"percentile":0.3367}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-27","epss":0.00396,"percentile":0.3367}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-27","epss":0.00396,"percentile":0.3367}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49528"},"relatedVulnerabilities":[{"id":"CVE-2023-49528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49528","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49528","date":"2026-10-27","epss":0.00396,"percentile":0.3367}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10691","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49528","description":"Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83400","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83400","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83400","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83400","date":"2026-10-27","epss":0.00396,"percentile":0.33635}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83400"},"relatedVulnerabilities":[{"id":"CVE-2026-83400","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83400","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83400","date":"2026-10-27","epss":0.00396,"percentile":0.33635}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83400","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83400","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83400","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83400","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83400","date":"2026-10-27","epss":0.00396,"percentile":0.33635}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83400"},"relatedVulnerabilities":[{"id":"CVE-2026-83400","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83400","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83400","date":"2026-10-27","epss":0.00396,"percentile":0.33635}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83400","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-27","epss":0.00396,"percentile":0.33604}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-27","epss":0.00396,"percentile":0.33604}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-27","epss":0.00396,"percentile":0.33604}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-27","epss":0.00396,"percentile":0.33604}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-27","epss":0.00396,"percentile":0.33604}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64833"},"relatedVulnerabilities":[{"id":"CVE-2026-64833","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64833","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64833","date":"2026-10-27","epss":0.00396,"percentile":0.33604}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/6f80e2765492700622596af720534cef33dd31b4","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23661","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-via-s-pdif-muxer-spdifenc-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64833","description":"FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a core_size value larger than the actual packet length. Attackers can exploit the missing bounds check in the spdif_header_dts4 function by providing a malicious DTS-HD audio stream during S/PDIF re-muxing to trigger unauthorized memory reads beyond the packet buffer."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-27","epss":0.00393,"percentile":0.33335}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-27","epss":0.00393,"percentile":0.33335}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-27","epss":0.00393,"percentile":0.33335}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-27","epss":0.00393,"percentile":0.33335}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7700","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-27","epss":0.00393,"percentile":0.33335}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7700"},"relatedVulnerabilities":[{"id":"CVE-2025-7700","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7700","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7700","date":"2026-10-27","epss":0.00393,"percentile":0.33335}],"urls":["https://access.redhat.com/security/cve/CVE-2025-7700","https://bugzilla.redhat.com/show_bug.cgi?id=2380420","https://github.com/FFmpeg/FFmpeg/commit/35a6de137a39f274d5e01ed0e0e6c4f04d0aaf07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7700","description":"A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87875","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87875","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-27","epss":0.00392,"percentile":0.33172}],"risk":0.196,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87875"},"relatedVulnerabilities":[{"id":"CVE-2026-87875","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87875","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87875","date":"2026-10-27","epss":0.00392,"percentile":0.33172}],"urls":["https://access.redhat.com/errata/RHSA-2026:66600","https://access.redhat.com/security/cve/CVE-2026-87875","https://bugzilla.redhat.com/show_bug.cgi?id=2530994","https://github.com/OpenPrinting/cups/commit/0c6842fc615e8afa284136a092da8178abf5f142","https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4","https://github.com/OpenPrinting/cups/security/advisories/GHSA-559w-7676-3xrq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87875","description":"The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-27","epss":0.00391,"percentile":0.33008}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-27","epss":0.00391,"percentile":0.33008}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-27","epss":0.00391,"percentile":0.33008}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-27","epss":0.00391,"percentile":0.33008}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-49501","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-49501","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-27","epss":0.00391,"percentile":0.33008}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-49501"},"relatedVulnerabilities":[{"id":"CVE-2023-49501","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-49501","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-49501","date":"2026-10-27","epss":0.00391,"percentile":0.33008}],"urls":["https://github.com/FFmpeg/FFmpeg","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10686","https://trac.ffmpeg.org/ticket/10686#no1","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-49501","description":"Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the config_eq_output function in the libavfilter/asrc_afirsrc.c:495:30 component."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15714","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15714","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15714","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15714","date":"2026-10-27","epss":0.0039,"percentile":0.32996}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15714"},"relatedVulnerabilities":[{"id":"CVE-2026-15714","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15714","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15714","date":"2026-10-27","epss":0.0039,"percentile":0.32996}],"urls":["https://access.redhat.com/security/cve/CVE-2026-15714","https://bugzilla.redhat.com/show_bug.cgi?id=2499942","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/542"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15714","description":"An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15714","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15714","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15714","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15714","date":"2026-10-27","epss":0.0039,"percentile":0.32996}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15714"},"relatedVulnerabilities":[{"id":"CVE-2026-15714","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15714","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15714","date":"2026-10-27","epss":0.0039,"percentile":0.32996}],"urls":["https://access.redhat.com/security/cve/CVE-2026-15714","https://bugzilla.redhat.com/show_bug.cgi?id=2499942","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/542"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15714","description":"An out-of-bounds read vulnerability was found in libsoup's multipart processing subsystem. The flaw exists in the soup_multipart_input_stream_read_headers() function inside soup-multipart-input-stream.c, which does not adequately restrict or validate the size of incoming multipart boundary strings. When processing a crafted HTTP response containing a malformed or oversized boundary parameter, the internal stream reader reads past the allocated buffer bounds. A remote, unauthenticated attacker can exploit this behavior to cause a service denial (DoS) through application failure or potentially read fragments of unauthorized memory metadata."}]},{"artifact":{"id":"03a1b62b39da5b54","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-1ubuntu5.24.04.1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/ubuntu/libsndfile1@1.2.2-1ubuntu5.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=libsndfile","type":"deb","version":"1.2.2-1ubuntu5.24.04.1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88372","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsndfile","version":"1.2.2-1ubuntu5.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88372","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88372","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88372","date":"2026-10-27","epss":0.0039,"percentile":0.32967}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88372"},"relatedVulnerabilities":[{"id":"CVE-2026-88372","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88372","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-88372","date":"2026-10-27","epss":0.0039,"percentile":0.32967}],"urls":["https://github.com/libsndfile/libsndfile/issues/1151"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88372","description":"libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47058","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47058","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47058","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47058","date":"2026-10-27","epss":0.00387,"percentile":0.3265}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47058"},"relatedVulnerabilities":[{"id":"CVE-2026-47058","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47058","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47058","date":"2026-10-27","epss":0.00387,"percentile":0.3265}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47058","description":"Vulnerability in Oracle Java SE (component: Scripting).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and  11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47058","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47058","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47058","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47058","date":"2026-10-27","epss":0.00387,"percentile":0.3265}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47058"},"relatedVulnerabilities":[{"id":"CVE-2026-47058","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47058","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47058","date":"2026-10-27","epss":0.00387,"percentile":0.3265}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-07-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47058","description":"Vulnerability in Oracle Java SE (component: Scripting).  Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and  11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102558","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102558","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102558","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102558","date":"2026-10-27","epss":0.00385,"percentile":0.32373}],"risk":0.1925,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102558"},"relatedVulnerabilities":[{"id":"CVE-2026-102558","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102558","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102558","date":"2026-10-27","epss":0.00385,"percentile":0.32373}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/errata/RHSA-2026:84586","https://access.redhat.com/security/cve/CVE-2026-102558","https://bugzilla.redhat.com/show_bug.cgi?id=2543274"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102558","description":"A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102558","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102558","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102558","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102558","date":"2026-10-27","epss":0.00385,"percentile":0.32373}],"risk":0.1925,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102558"},"relatedVulnerabilities":[{"id":"CVE-2026-102558","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102558","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102558","date":"2026-10-27","epss":0.00385,"percentile":0.32373}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/errata/RHSA-2026:84586","https://access.redhat.com/security/cve/CVE-2026-102558","https://bugzilla.redhat.com/show_bug.cgi?id=2543274"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102558","description":"A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-27","epss":0.00384,"percentile":0.32261}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-27","epss":0.00384,"percentile":0.32261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-27","epss":0.00384,"percentile":0.32261}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-27","epss":0.00384,"percentile":0.32261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-63757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-63757","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-27","epss":0.00384,"percentile":0.32261}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-63757"},"relatedVulnerabilities":[{"id":"CVE-2025-63757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-63757","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-63757","date":"2026-10-27","epss":0.00384,"percentile":0.32261}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20698","https://ffmpeg.org/security.html","https://gist.github.com/miora-sora/43c1c5616dd5b4f960a9d20296ef4833"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-63757","description":"Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0716","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0716","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0716","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0716","date":"2026-10-27","epss":0.00382,"percentile":0.3205}],"risk":0.191,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0716"},"relatedVulnerabilities":[{"id":"CVE-2026-0716","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0716","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0716","date":"2026-10-27","epss":0.00382,"percentile":0.3205}],"urls":["https://access.redhat.com/security/cve/CVE-2026-0716","https://bugzilla.redhat.com/show_bug.cgi?id=2427896","https://gitlab.gnome.org/GNOME/libsoup/-/issues/476"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0716","description":"A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0716","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0716","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0716","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0716","date":"2026-10-27","epss":0.00382,"percentile":0.3205}],"risk":0.191,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0716"},"relatedVulnerabilities":[{"id":"CVE-2026-0716","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0716","cwe":"CWE-805","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-0716","date":"2026-10-27","epss":0.00382,"percentile":0.3205}],"urls":["https://access.redhat.com/security/cve/CVE-2026-0716","https://bugzilla.redhat.com/show_bug.cgi?id=2427896","https://gitlab.gnome.org/GNOME/libsoup/-/issues/476"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0716","description":"A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted."}]},{"artifact":{"id":"b904160816bf0fae","cpes":["cpe:2.3:a:xserver-common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver-common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xserver-common","purl":"pkg:deb/ubuntu/xserver-common@2%3A21.1.12-1ubuntu1.8?arch=all&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xserver-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xserver-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33999","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33999","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33999","date":"2026-10-27","epss":0.0038,"percentile":0.31839}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33999"},"relatedVulnerabilities":[{"id":"CVE-2026-33999","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33999","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33999","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33999","date":"2026-10-27","epss":0.0038,"percentile":0.31839}],"urls":["https://access.redhat.com/errata/RHSA-2026:10739","https://access.redhat.com/errata/RHSA-2026:11352","https://access.redhat.com/errata/RHSA-2026:11369","https://access.redhat.com/errata/RHSA-2026:11388","https://access.redhat.com/errata/RHSA-2026:11656","https://access.redhat.com/errata/RHSA-2026:11692","https://access.redhat.com/errata/RHSA-2026:13414","https://access.redhat.com/errata/RHSA-2026:19125","https://access.redhat.com/errata/RHSA-2026:19342","https://access.redhat.com/errata/RHSA-2026:19343","https://access.redhat.com/errata/RHSA-2026:19344","https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-33999","https://bugzilla.redhat.com/show_bug.cgi?id=2451106","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33999.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33999","description":"A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts."}]},{"artifact":{"id":"670a92a0d828ff64","cpes":["cpe:2.3:a:xvfb:xvfb:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xvfb","purl":"pkg:deb/ubuntu/xvfb@2%3A21.1.12-1ubuntu1.8?arch=amd64&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xvfb/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xvfb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-33999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33999","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33999","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33999","date":"2026-10-27","epss":0.0038,"percentile":0.31839}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33999"},"relatedVulnerabilities":[{"id":"CVE-2026-33999","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33999","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33999","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33999","date":"2026-10-27","epss":0.0038,"percentile":0.31839}],"urls":["https://access.redhat.com/errata/RHSA-2026:10739","https://access.redhat.com/errata/RHSA-2026:11352","https://access.redhat.com/errata/RHSA-2026:11369","https://access.redhat.com/errata/RHSA-2026:11388","https://access.redhat.com/errata/RHSA-2026:11656","https://access.redhat.com/errata/RHSA-2026:11692","https://access.redhat.com/errata/RHSA-2026:13414","https://access.redhat.com/errata/RHSA-2026:19125","https://access.redhat.com/errata/RHSA-2026:19342","https://access.redhat.com/errata/RHSA-2026:19343","https://access.redhat.com/errata/RHSA-2026:19344","https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-33999","https://bugzilla.redhat.com/show_bug.cgi?id=2451106","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33999.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33999","description":"A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-27","epss":0.00377,"percentile":0.31548}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-27","epss":0.00377,"percentile":0.31548}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-27","epss":0.00377,"percentile":0.31548}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-27","epss":0.00377,"percentile":0.31548}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-27","epss":0.00377,"percentile":0.31548}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0518"},"relatedVulnerabilities":[{"id":"CVE-2025-0518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0518","cwe":"CWE-125","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"},{"cve":"CVE-2025-0518","cwe":"CWE-252","type":"Secondary","source":"96148269-fe82-4198-b1bf-3a73ce8bc92e"}],"epss":[{"cve":"CVE-2025-0518","date":"2026-10-27","epss":0.00377,"percentile":0.31548}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0518","description":"Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files  https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C .\n\nThis issue affects FFmpeg: 7.1.\n\nIssue was fixed:  https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a\n\n https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosman"}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91382","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91382","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91382","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91382","date":"2026-10-27","epss":0.00377,"percentile":0.315}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91382"},"relatedVulnerabilities":[{"id":"CVE-2026-91382","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91382","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91382","date":"2026-10-27","epss":0.00377,"percentile":0.315}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91382","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91382","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91382","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91382","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91382","date":"2026-10-27","epss":0.00377,"percentile":0.315}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91382"},"relatedVulnerabilities":[{"id":"CVE-2026-91382","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91382","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91382","date":"2026-10-27","epss":0.00377,"percentile":0.315}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91382","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L)."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-27","epss":0.00374,"percentile":0.31154}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-27","epss":0.00374,"percentile":0.31154}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-27","epss":0.00374,"percentile":0.31154}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-27","epss":0.00374,"percentile":0.31154}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-27","epss":0.00374,"percentile":0.31154}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50008"},"relatedVulnerabilities":[{"id":"CVE-2023-50008","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50008","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50008","date":"2026-10-27","epss":0.00374,"percentile":0.31154}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/5f87a68cf70dafeab2fb89b42e41a4c29053b89b","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10701","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50008","description":"FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component."}]},{"artifact":{"id":"f2f9ea64412a82e3","cpes":["cpe:2.3:a:libavahi-client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_client3:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_client3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-client3","purl":"pkg:deb/ubuntu/libavahi-client3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-client3/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavahi-client3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavahi-client3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-27","epss":0.00622,"percentile":0.49617}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52615"},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-27","epss":0.00622,"percentile":0.49617}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"e190b3f2d6ee823a","cpes":["cpe:2.3:a:libavahi-common-data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common-data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common_data:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common-data:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common_data:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common-data","purl":"pkg:deb/ubuntu/libavahi-common-data@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common-data/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavahi-common-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavahi-common-data:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-27","epss":0.00622,"percentile":0.49617}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52615"},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-27","epss":0.00622,"percentile":0.49617}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"1439f27e2c1f750c","cpes":["cpe:2.3:a:libavahi-common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi-common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi_common3:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi-common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*","cpe:2.3:a:libavahi:libavahi_common3:0.8-13ubuntu6.2:*:*:*:*:*:*:*"],"name":"libavahi-common3","purl":"pkg:deb/ubuntu/libavahi-common3@0.8-13ubuntu6.2?arch=amd64&distro=ubuntu-24.04&upstream=avahi","type":"deb","version":"0.8-13ubuntu6.2","language":"","licenses":["sha256:66849d0ab7cbf0d770e40e00276ed8d264ed8974c0e064fb12814c0f80430c5d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavahi-common3/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavahi-common3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavahi-common3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"avahi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-52615","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"avahi","version":"0.8-13ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-52615","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-27","epss":0.00622,"percentile":0.49617}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-52615"},"relatedVulnerabilities":[{"id":"CVE-2024-52615","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52615","cwe":"CWE-330","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-52615","date":"2026-10-27","epss":0.00622,"percentile":0.49617}],"urls":["https://access.redhat.com/errata/RHSA-2025:11402","https://access.redhat.com/errata/RHSA-2025:16441","https://access.redhat.com/security/cve/CVE-2024-52615","https://bugzilla.redhat.com/show_bug.cgi?id=2326418","https://github.com/avahi/avahi/pull/577"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52615","description":"A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-27","epss":0.00372,"percentile":0.30962}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-27","epss":0.00372,"percentile":0.30962}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-27","epss":0.00372,"percentile":0.30962}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-27","epss":0.00372,"percentile":0.30962}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-22921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-22921","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-27","epss":0.00372,"percentile":0.30962}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-22921"},"relatedVulnerabilities":[{"id":"CVE-2025-22921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-22921","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-22921","date":"2026-10-27","epss":0.00372,"percentile":0.30962}],"urls":["https://trac.ffmpeg.org/ticket/11393","https://lists.debian.org/debian-lts-announce/2025/02/msg00037.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22921","description":"FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102555","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102555","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102555","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102555","date":"2026-10-27","epss":0.00369,"percentile":0.30596}],"risk":0.1845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102555"},"relatedVulnerabilities":[{"id":"CVE-2026-102555","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102555","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102555","date":"2026-10-27","epss":0.00369,"percentile":0.30596}],"urls":["https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/security/cve/CVE-2026-102555","https://bugzilla.redhat.com/show_bug.cgi?id=2543224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102555","description":"A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102555","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102555","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102555","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102555","date":"2026-10-27","epss":0.00369,"percentile":0.30596}],"risk":0.1845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102555"},"relatedVulnerabilities":[{"id":"CVE-2026-102555","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102555","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102555","date":"2026-10-27","epss":0.00369,"percentile":0.30596}],"urls":["https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/security/cve/CVE-2026-102555","https://bugzilla.redhat.com/show_bug.cgi?id=2543224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102555","description":"A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-27","epss":0.00368,"percentile":0.30469}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-27","epss":0.00368,"percentile":0.30469}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-27","epss":0.00368,"percentile":0.30464}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-27","epss":0.00368,"percentile":0.30464}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-27","epss":0.00368,"percentile":0.30464}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-27","epss":0.00368,"percentile":0.30464}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-6605","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-6605","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-27","epss":0.00368,"percentile":0.30464}],"risk":0.184,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-6605"},"relatedVulnerabilities":[{"id":"CVE-2023-6605","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-6605","cwe":"CWE-99","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2023-6605","date":"2026-10-27","epss":0.00368,"percentile":0.30464}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2334336","https://lists.debian.org/debian-lts-announce/2025/07/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-6605","description":"A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs."}]},{"artifact":{"id":"b904160816bf0fae","cpes":["cpe:2.3:a:xserver-common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver-common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xserver-common","purl":"pkg:deb/ubuntu/xserver-common@2%3A21.1.12-1ubuntu1.8?arch=all&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xserver-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xserver-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-5574","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-5574","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-5574","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-5574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5574","date":"2026-10-27","epss":0.00608,"percentile":0.48862}],"risk":0.1824,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-5574"},"relatedVulnerabilities":[{"id":"CVE-2023-5574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5574","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-5574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5574","date":"2026-10-27","epss":0.00608,"percentile":0.48862}],"urls":["https://access.redhat.com/errata/RHSA-2024:2298","https://access.redhat.com/security/cve/CVE-2023-5574","https://bugzilla.redhat.com/show_bug.cgi?id=2244735","https://lists.x.org/archives/xorg-announce/2023-October/003430.html","https://security.netapp.com/advisory/ntap-20231130-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5574","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service."}]},{"artifact":{"id":"670a92a0d828ff64","cpes":["cpe:2.3:a:xvfb:xvfb:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xvfb","purl":"pkg:deb/ubuntu/xvfb@2%3A21.1.12-1ubuntu1.8?arch=amd64&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xvfb/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xvfb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-5574","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-5574","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-5574","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-5574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5574","date":"2026-10-27","epss":0.00608,"percentile":0.48862}],"risk":0.1824,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-5574"},"relatedVulnerabilities":[{"id":"CVE-2023-5574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5574","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-5574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5574","date":"2026-10-27","epss":0.00608,"percentile":0.48862}],"urls":["https://access.redhat.com/errata/RHSA-2024:2298","https://access.redhat.com/security/cve/CVE-2023-5574","https://bugzilla.redhat.com/show_bug.cgi?id=2244735","https://lists.x.org/archives/xorg-announce/2023-October/003430.html","https://security.netapp.com/advisory/ntap-20231130-0004/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5574","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-10-27","epss":0.00361,"percentile":0.29674}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-10-27","epss":0.00361,"percentile":0.29674}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-10-27","epss":0.00361,"percentile":0.29674}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-10-27","epss":0.00361,"percentile":0.29674}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-10-27","epss":0.00361,"percentile":0.29674}],"risk":0.1805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18393"},"relatedVulnerabilities":[{"id":"CVE-2026-18393","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.4,"impactScore":4.3,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18393","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18393","date":"2026-10-27","epss":0.00361,"percentile":0.29674}],"urls":["https://access.redhat.com/security/cve/CVE-2026-18393","https://bugzilla.redhat.com/show_bug.cgi?id=2520309","https://github.com/FFmpeg/FFmpeg/commit/242ff799c75f20bade946314c8d741d0887ee11c","https://patchwork.ffmpeg.org/project/ffmpeg/patch/177767065817.63.1948165304485903849@29965ddac10e/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18393","description":"A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond\nthe bounds of a heap-allocated buffer when processing crafted TDSC cursor\ndata. A remote attacker could exploit this by supplying a specially crafted\nvideo file, potentially leading to a denial of service or arbitrary code\nexecution."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107696"},"relatedVulnerabilities":[{"id":"CVE-2026-107696","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107696","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107696","date":"2026-10-27","epss":0.00359,"percentile":0.29494}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902","https://gist.github.com/OxBat/648a0bd60c898f2ffb418e131ce26013","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavformat/rtsp.c#L2225","https://www.vulncheck.com/advisories/ffmpeg-through-9.0.2-infinite-loop-via-rtsp-redirect-handling-in-rtsp-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","description":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-92391","versionConstraint":">= 7.56.0, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92391","date":"2026-10-27","epss":0.00358,"percentile":0.29412}],"risk":0.179,"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."},"relatedVulnerabilities":[]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-10-27","epss":0.00355,"percentile":0.28992}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-10-27","epss":0.00355,"percentile":0.28992}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-10-27","epss":0.00355,"percentile":0.28992}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-10-27","epss":0.00355,"percentile":0.28992}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38343","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38343","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-10-27","epss":0.00355,"percentile":0.28992}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38343"},"relatedVulnerabilities":[{"id":"CVE-2026-38343","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38343","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38343","date":"2026-10-27","epss":0.00355,"percentile":0.28992}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21587"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38343","description":"An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-10-27","epss":0.00355,"percentile":0.28991}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-10-27","epss":0.00355,"percentile":0.28991}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-10-27","epss":0.00355,"percentile":0.28991}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-10-27","epss":0.00355,"percentile":0.28991}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-38345","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-38345","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-10-27","epss":0.00355,"percentile":0.28991}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-38345"},"relatedVulnerabilities":[{"id":"CVE-2026-38345","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-38345","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-38345","date":"2026-10-27","epss":0.00355,"percentile":0.28991}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/21585"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-38345","description":"A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75466","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75466","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-10-27","epss":0.00355,"percentile":0.2899}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75466"},"relatedVulnerabilities":[{"id":"CVE-2026-75466","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-10-27","epss":0.00355,"percentile":0.2899}],"urls":["https://github.com/libjpeg-turbo/libjpeg-turbo/issues/911"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32230","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"risk":0.17600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32230"},"relatedVulnerabilities":[{"id":"CVE-2024-32230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-32230","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32230","date":"2026-10-27","epss":0.00352,"percentile":0.28661}],"urls":["https://trac.ffmpeg.org/ticket/10952"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32230","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a negative-size-param bug at libavcodec/mpegvideo_enc.c:1216:21 in load_input_picture in FFmpeg7.0"}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-10-27","epss":0.0035,"percentile":0.28457}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-10-27","epss":0.0035,"percentile":0.28457}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-10-27","epss":0.0035,"percentile":0.28457}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-10-27","epss":0.0035,"percentile":0.28457}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50007","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-50007","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-10-27","epss":0.0035,"percentile":0.28457}],"risk":0.17500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50007"},"relatedVulnerabilities":[{"id":"CVE-2023-50007","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-50007","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-50007","date":"2026-10-27","epss":0.0035,"percentile":0.28457}],"urls":["https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://trac.ffmpeg.org/ticket/10700","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50007","description":"FFmpeg v.n6.1-3-g466799d4f5 allows an attacker to trigger use of a parameter of negative size in the av_samples_set_silence function in thelibavutil/samplefmt.c:260:9 component."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15713","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15713","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15713","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15713","date":"2026-10-27","epss":0.00349,"percentile":0.28327}],"risk":0.1745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15713"},"relatedVulnerabilities":[{"id":"CVE-2026-15713","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15713","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15713","date":"2026-10-27","epss":0.00349,"percentile":0.28327}],"urls":["https://access.redhat.com/security/cve/CVE-2026-15713","https://bugzilla.redhat.com/show_bug.cgi?id=2499941","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15713","description":"A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15713","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15713","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15713","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15713","date":"2026-10-27","epss":0.00349,"percentile":0.28327}],"risk":0.1745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15713"},"relatedVulnerabilities":[{"id":"CVE-2026-15713","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15713","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-15713","date":"2026-10-27","epss":0.00349,"percentile":0.28327}],"urls":["https://access.redhat.com/security/cve/CVE-2026-15713","https://bugzilla.redhat.com/show_bug.cgi?id=2499941","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15713","description":"A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to correctly release memory context blocks under specific stream termination conditions, such as when an HTTP/2 connection encounters window exhaustion or explicit stream resets. A remote, unauthenticated attacker acting as a malicious network peer can trick the connection engine into allocating stream states that are subsequently leaked during cleanup. Over a sustained period, this flaw allows the remote attacker to consume the system's heap allocations incrementally, triggering a denial of service (DoS) through an ultimate Out-of-Memory (OOM) application crash."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-27","epss":0.00348,"percentile":0.28259}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-27","epss":0.00348,"percentile":0.28259}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-10-27","epss":0.00348,"percentile":0.2818}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-10-27","epss":0.00348,"percentile":0.2818}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-10-27","epss":0.00348,"percentile":0.2818}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-10-27","epss":0.00348,"percentile":0.2818}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10256","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10256","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-10-27","epss":0.00348,"percentile":0.2818}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10256"},"relatedVulnerabilities":[{"id":"CVE-2025-10256","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"patrick@puiterwijk.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10256","cwe":"CWE-476","type":"Secondary","source":"patrick@puiterwijk.org"}],"epss":[{"cve":"CVE-2025-10256","date":"2026-10-27","epss":0.00348,"percentile":0.2818}],"urls":["https://access.redhat.com/security/cve/CVE-2025-10256","https://bugzilla.redhat.com/show_bug.cgi?id=2394495","https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931","https://github.com/FFmpeg/FFmpeg/commit/d3be186ed1bcdcf2c093d6b13a0e66dc5132be2a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10256","description":"A NULL pointer dereference vulnerability exists in FFmpeg’s Firequalizer filter (libavfilter/af_firequalizer.c) due to a missing check on the return value of av_malloc_array() in the config_input() function. An attacker could exploit this by tricking a victim into processing a crafted media file with the Firequalizer filter enabled, causing the application to dereference a NULL pointer and crash, leading to denial of service."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-10-27","epss":0.00344,"percentile":0.27774}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-10-27","epss":0.00344,"percentile":0.27774}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-10-27","epss":0.00344,"percentile":0.27774}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-10-27","epss":0.00344,"percentile":0.27774}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-31582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-31582","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-10-27","epss":0.00344,"percentile":0.27774}],"risk":0.172,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-31582"},"relatedVulnerabilities":[{"id":"CVE-2024-31582","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-31582","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-31582","date":"2026-10-27","epss":0.00344,"percentile":0.27774}],"urls":["https://gist.github.com/1047524396/b47d5efe3bc420fb91dbb77c73c0fff3","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavfilter/vf_codecview.c#L220","https://github.com/ffmpeg/ffmpeg/commit/99debe5f823f45a482e1dc08de35879aa9c74bd2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPETICRXUOGRIM4U3BCRTIKE3IZWCSBT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LE3ASLH6QF2E5OVJI5VA3JSEPJFFFMNY/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-31582","description":"FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-92387","versionConstraint":">= 8.10.0, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92387","date":"2026-10-27","epss":0.00341,"percentile":0.27437}],"risk":0.17049999999999998,"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."},"relatedVulnerabilities":[]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-94265","versionConstraint":">= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-94265","date":"2026-10-27","epss":0.00338,"percentile":0.27121}],"risk":0.169,"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."},"relatedVulnerabilities":[]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"c63c50e09a049480","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"cd1ded1d948407f7","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-30997","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-30997","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"risk":0.1685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-30997"},"relatedVulnerabilities":[{"id":"CVE-2026-30997","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-30997","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-30997","date":"2026-10-27","epss":0.00337,"percentile":0.26969}],"urls":["https://excellent-oatmeal-319.notion.site/CVE-2026-30997-Out-of-Bounds-Access-a7929817b9794568b2f7774397c7d65f","https://github.com/FFmpeg/FFmpeg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-30997","description":"An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-27","epss":0.00335,"percentile":0.26687}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-27","epss":0.00335,"percentile":0.26687}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-27","epss":0.00335,"percentile":0.26687}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-27","epss":0.00335,"percentile":0.26687}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-64832","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-64832","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-27","epss":0.00335,"percentile":0.26687}],"risk":0.1675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-64832"},"relatedVulnerabilities":[{"id":"CVE-2026-64832","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-64832","cwe":"CWE-415","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-64832","date":"2026-10-27","epss":0.00335,"percentile":0.26687}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4c6217477fc64305055b37d9d1d0d76d30e37f97","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23664","https://www.vulncheck.com/advisories/ffmpeg-double-free-in-nvdec-hardware-decoder-via-nvdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-64832","description":"FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to trigger memory corruption by supplying a crafted video file. When no decoder surfaces remain, the ff_nvdec_start_frame_sep_ref error path frees memory via nvdec_fdd_priv_free while the calling layer subsequently frees the same frame description data, resulting in a double-free of the underlying decoder context in any FFmpeg-based application using NVDEC hardware-accelerated decoding."}]},{"artifact":{"id":"b904160816bf0fae","cpes":["cpe:2.3:a:xserver-common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver-common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xserver-common","purl":"pkg:deb/ubuntu/xserver-common@2%3A21.1.12-1ubuntu1.8?arch=all&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xserver-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xserver-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-55999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-55999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-55999","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-55999","date":"2026-10-27","epss":0.00333,"percentile":0.26372}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-55999"},"relatedVulnerabilities":[{"id":"CVE-2026-55999","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55999","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-55999","date":"2026-10-27","epss":0.00333,"percentile":0.26372}],"urls":["https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1","https://www.openwall.com/lists/oss-security/2026/07/08/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55999","description":"Local attackers with a X connection able to provide PCX fonts to the X \nserver xorg-server before 21.2.24 and xwayland before 24.1.13 could \ncause a heap buffer overflow via SetFont due to missing glyph boundary checks."}]},{"artifact":{"id":"670a92a0d828ff64","cpes":["cpe:2.3:a:xvfb:xvfb:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xvfb","purl":"pkg:deb/ubuntu/xvfb@2%3A21.1.12-1ubuntu1.8?arch=amd64&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xvfb/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xvfb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-55999","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-55999","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-55999","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-55999","date":"2026-10-27","epss":0.00333,"percentile":0.26372}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-55999"},"relatedVulnerabilities":[{"id":"CVE-2026-55999","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-55999","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-55999","date":"2026-10-27","epss":0.00333,"percentile":0.26372}],"urls":["https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1","https://www.openwall.com/lists/oss-security/2026/07/08/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-55999","description":"Local attackers with a X connection able to provide PCX fonts to the X \nserver xorg-server before 21.2.24 and xwayland before 24.1.13 could \ncause a heap buffer overflow via SetFont due to missing glyph boundary checks."}]},{"artifact":{"id":"eb3e4a5365ae61d2","cpes":["cpe:2.3:a:cpp:cpp:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*"],"name":"cpp","purl":"pkg:deb/ubuntu/cpp@4%3A13.2.0-7ubuntu1?arch=amd64&distro=ubuntu-24.04&upstream=gcc-defaults%401.214ubuntu1","type":"deb","version":"4:13.2.0-7ubuntu1","language":"","licenses":["BSD-4-Clause","GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cpp-x86-64-linux-gnu/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/cpp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp.list","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.list"},{"path":"/var/lib/dpkg/info/cpp.postinst","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.postinst"},{"path":"/var/lib/dpkg/info/cpp.postrm","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.postrm"},{"path":"/var/lib/dpkg/info/cpp.preinst","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.preinst"},{"path":"/var/lib/dpkg/info/cpp.prerm","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp.prerm"}],"upstreams":[{"name":"gcc-defaults","version":"1.214ubuntu1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-defaults","version":"1.214ubuntu1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"ea6661ccba0de10e","cpes":["cpe:2.3:a:cpp-13:cpp-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13:cpp_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13:cpp-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13:cpp_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp-13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp_13:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*"],"name":"cpp-13","purl":"pkg:deb/ubuntu/cpp-13@13.3.0-6ubuntu2~24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=gcc-13","type":"deb","version":"13.3.0-6ubuntu2~24.04.1","language":"","licenses":["sha256:08c6f3dee4c19aa1e57eb7d4ad45829b2e99656313bd07fa0922e2553f500be5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-13-base/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/cpp-13/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-13.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp-13.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-13.list","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp-13.list"}],"upstreams":[{"name":"gcc-13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-13","version":"13.3.0-6ubuntu2~24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"f86d22bca86f6dcd","cpes":["cpe:2.3:a:cpp-13-x86-64-linux-gnu:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13-x86-64-linux-gnu:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13_x86_64_linux_gnu:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13_x86_64_linux_gnu:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13-x86-64-linux:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13-x86-64-linux:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13_x86_64_linux:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13_x86_64_linux:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13-x86-64:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13-x86-64:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13_x86_64:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13_x86_64:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13-x86:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13-x86:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13_x86:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13_x86:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-13:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_13:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp-13-x86-64-linux-gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp_13_x86_64_linux_gnu:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*"],"name":"cpp-13-x86-64-linux-gnu","purl":"pkg:deb/ubuntu/cpp-13-x86-64-linux-gnu@13.3.0-6ubuntu2~24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=gcc-13","type":"deb","version":"13.3.0-6ubuntu2~24.04.1","language":"","licenses":["sha256:08c6f3dee4c19aa1e57eb7d4ad45829b2e99656313bd07fa0922e2553f500be5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-13-base/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/cpp-13-x86-64-linux-gnu/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-13-x86-64-linux-gnu.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp-13-x86-64-linux-gnu.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-13-x86-64-linux-gnu.list","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp-13-x86-64-linux-gnu.list"}],"upstreams":[{"name":"gcc-13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-13","version":"13.3.0-6ubuntu2~24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"cbf15ec0f2ef7744","cpes":["cpe:2.3:a:cpp-x86-64-linux-gnu:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64-linux-gnu:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64_linux_gnu:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64_linux_gnu:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64-linux:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64-linux:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64_linux:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64_linux:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86-64:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86_64:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp-x86:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp_x86:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp-x86-64-linux-gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:cpp:cpp_x86_64_linux_gnu:4\\:13.2.0-7ubuntu1:*:*:*:*:*:*:*"],"name":"cpp-x86-64-linux-gnu","purl":"pkg:deb/ubuntu/cpp-x86-64-linux-gnu@4%3A13.2.0-7ubuntu1?arch=amd64&distro=ubuntu-24.04&upstream=gcc-defaults%401.214ubuntu1","type":"deb","version":"4:13.2.0-7ubuntu1","language":"","licenses":["BSD-4-Clause","GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/cpp-x86-64-linux-gnu/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/cpp-x86-64-linux-gnu/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-x86-64-linux-gnu.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp-x86-64-linux-gnu.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/cpp-x86-64-linux-gnu.list","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/cpp-x86-64-linux-gnu.list"}],"upstreams":[{"name":"gcc-defaults","version":"1.214ubuntu1"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-defaults","version":"1.214ubuntu1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"6a2087386332c063","cpes":["cpe:2.3:a:gcc-13-base:gcc-13-base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-13-base:gcc_13_base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13_base:gcc-13-base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13_base:gcc_13_base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-13:gcc-13-base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-13:gcc_13_base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc-13-base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_13:gcc_13_base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-13-base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_13_base:13.3.0-6ubuntu2\\~24.04.1:*:*:*:*:*:*:*"],"name":"gcc-13-base","purl":"pkg:deb/ubuntu/gcc-13-base@13.3.0-6ubuntu2~24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=gcc-13","type":"deb","version":"13.3.0-6ubuntu2~24.04.1","language":"","licenses":["sha256:08c6f3dee4c19aa1e57eb7d4ad45829b2e99656313bd07fa0922e2553f500be5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-13-base/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/gcc-13-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-13-base:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/gcc-13-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-13"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gcc-13","version":"13.3.0-6ubuntu2~24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-10-27","epss":0.00333,"percentile":0.26359}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91396","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91396","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91396","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91396","date":"2026-10-27","epss":0.00333,"percentile":0.26336}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91396"},"relatedVulnerabilities":[{"id":"CVE-2026-91396","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91396","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91396","date":"2026-10-27","epss":0.00333,"percentile":0.26336}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91396","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91396","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91396","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91396","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91396","date":"2026-10-27","epss":0.00333,"percentile":0.26336}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91396"},"relatedVulnerabilities":[{"id":"CVE-2026-91396","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91396","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91396","date":"2026-10-27","epss":0.00333,"percentile":0.26336}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91396","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87876","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-10-27","epss":0.00328,"percentile":0.25731}],"risk":0.164,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87876"},"relatedVulnerabilities":[{"id":"CVE-2026-87876","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":3,"impactScore":1.5,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87876","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-87876","date":"2026-10-27","epss":0.00328,"percentile":0.25731}],"urls":["https://access.redhat.com/errata/RHSA-2026:67568","https://access.redhat.com/security/cve/CVE-2026-87876","https://bugzilla.redhat.com/show_bug.cgi?id=2530991","https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8","https://github.com/OpenPrinting/cups/commit/f56844dbe4a54a9f8e1aeb3b913fbee614156bdb","https://github.com/OpenPrinting/cups/security/advisories/GHSA-r8jp-q6fh-g5r2"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87876","description":"Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83395","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83395","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83395","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83395","date":"2026-10-27","epss":0.00327,"percentile":0.25666}],"risk":0.1635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83395"},"relatedVulnerabilities":[{"id":"CVE-2026-83395","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83395","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83395","date":"2026-10-27","epss":0.00327,"percentile":0.25666}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83395","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83395","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83395","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83395","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83395","date":"2026-10-27","epss":0.00327,"percentile":0.25666}],"risk":0.1635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83395"},"relatedVulnerabilities":[{"id":"CVE-2026-83395","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83395","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83395","date":"2026-10-27","epss":0.00327,"percentile":0.25666}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83395","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87290","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87290","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87290","date":"2026-10-27","epss":0.00327,"percentile":0.25655}],"risk":0.1635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87290"},"relatedVulnerabilities":[{"id":"CVE-2026-87290","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87290","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87290","date":"2026-10-27","epss":0.00327,"percentile":0.25655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87290","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87290","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87290","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87290","date":"2026-10-27","epss":0.00327,"percentile":0.25655}],"risk":0.1635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87290"},"relatedVulnerabilities":[{"id":"CVE-2026-87290","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87290","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87290","date":"2026-10-27","epss":0.00327,"percentile":0.25655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87290","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83387","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83387","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83387","date":"2026-10-27","epss":0.00327,"percentile":0.25654}],"risk":0.1635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83387"},"relatedVulnerabilities":[{"id":"CVE-2026-83387","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83387","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83387","date":"2026-10-27","epss":0.00327,"percentile":0.25654}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83387","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83387","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83387","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83387","date":"2026-10-27","epss":0.00327,"percentile":0.25654}],"risk":0.1635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83387"},"relatedVulnerabilities":[{"id":"CVE-2026-83387","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83387","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83387","date":"2026-10-27","epss":0.00327,"percentile":0.25654}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83387","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87255","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87255","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87255","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87255","date":"2026-10-27","epss":0.00325,"percentile":0.25434}],"risk":0.1625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87255"},"relatedVulnerabilities":[{"id":"CVE-2026-87255","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87255","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87255","date":"2026-10-27","epss":0.00325,"percentile":0.25434}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87255","description":"Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87255","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87255","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87255","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87255","date":"2026-10-27","epss":0.00325,"percentile":0.25434}],"risk":0.1625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87255"},"relatedVulnerabilities":[{"id":"CVE-2026-87255","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87255","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87255","date":"2026-10-27","epss":0.00325,"percentile":0.25434}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87255","description":"Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83380","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83380","date":"2026-10-27","epss":0.00325,"percentile":0.25396}],"risk":0.1625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83380"},"relatedVulnerabilities":[{"id":"CVE-2026-83380","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83380","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83380","date":"2026-10-27","epss":0.00325,"percentile":0.25396}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83380","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83380","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83380","date":"2026-10-27","epss":0.00325,"percentile":0.25396}],"risk":0.1625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83380"},"relatedVulnerabilities":[{"id":"CVE-2026-83380","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83380","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83380","date":"2026-10-27","epss":0.00325,"percentile":0.25396}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83380","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87291","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87291","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87291","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87291","date":"2026-10-27","epss":0.00325,"percentile":0.25395}],"risk":0.1625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87291"},"relatedVulnerabilities":[{"id":"CVE-2026-87291","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87291","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87291","date":"2026-10-27","epss":0.00325,"percentile":0.25395}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87291","description":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87291","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87291","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87291","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87291","date":"2026-10-27","epss":0.00325,"percentile":0.25395}],"risk":0.1625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87291"},"relatedVulnerabilities":[{"id":"CVE-2026-87291","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87291","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87291","date":"2026-10-27","epss":0.00325,"percentile":0.25395}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87291","description":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"03a1b62b39da5b54","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-1ubuntu5.24.04.1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/ubuntu/libsndfile1@1.2.2-1ubuntu5.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=libsndfile","type":"deb","version":"1.2.2-1ubuntu5.24.04.1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-50613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsndfile","version":"1.2.2-1ubuntu5.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-50613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50613","date":"2026-10-27","epss":0.0054,"percentile":0.45239}],"risk":0.162,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-50613"},"relatedVulnerabilities":[{"id":"CVE-2024-50613","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-50613","cwe":"CWE-617","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-50613","date":"2026-10-27","epss":0.0054,"percentile":0.45239}],"urls":["https://github.com/libsndfile/libsndfile/issues/1034"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50613","description":"libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2708","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2708","date":"2026-10-27","epss":0.00321,"percentile":0.24989}],"risk":0.1605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2708"},"relatedVulnerabilities":[{"id":"CVE-2026-2708","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2708","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2708","date":"2026-10-27","epss":0.00321,"percentile":0.24989}],"urls":["https://access.redhat.com/security/cve/CVE-2026-2708","https://bugzilla.redhat.com/show_bug.cgi?id=2440743","https://gitlab.gnome.org/GNOME/libsoup/-/issues/500","https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2708","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2708","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2708","date":"2026-10-27","epss":0.00321,"percentile":0.24989}],"risk":0.1605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2708"},"relatedVulnerabilities":[{"id":"CVE-2026-2708","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2708","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-2708","date":"2026-10-27","epss":0.00321,"percentile":0.24989}],"urls":["https://access.redhat.com/security/cve/CVE-2026-2708","https://bugzilla.redhat.com/show_bug.cgi?id=2440743","https://gitlab.gnome.org/GNOME/libsoup/-/issues/500","https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/513"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2708","description":"A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6599","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6599","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94448","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94448","date":"2026-10-27","epss":0.00289,"percentile":0.21312}],"risk":0.160395,"urls":["https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/839866","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.\n\nWe now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-94448","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94448","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94448","date":"2026-10-27","epss":0.00289,"percentile":0.21312}],"urls":["https://go.dev/cl/839866","https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6599"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94448","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6600","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6600","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97030","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97030","date":"2026-10-27","epss":0.00289,"percentile":0.21312}],"risk":0.160395,"urls":["https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/840925","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.\n\nWe now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-97030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97030","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97030","date":"2026-10-27","epss":0.00289,"percentile":0.21312}],"urls":["https://go.dev/cl/840925","https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6600"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97030","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-27","epss":0.0032,"percentile":0.24788}],"risk":0.16,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-27","epss":0.0032,"percentile":0.24788}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-27","epss":0.00319,"percentile":0.24774}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-27","epss":0.00319,"percentile":0.24774}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-27","epss":0.00319,"percentile":0.24774}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-27","epss":0.00319,"percentile":0.24774}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-27","epss":0.00319,"percentile":0.24774}],"risk":0.1595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107697"},"relatedVulnerabilities":[{"id":"CVE-2026-107697","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107697","cwe":"CWE-693","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107697","date":"2026-10-27","epss":0.00319,"percentile":0.24774}],"urls":["https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n8.1.2/libavformat/hls.c#L834","https://github.com/FFmpeg/FFmpeg/commit/01044d04536e","https://github.com/FFmpeg/FFmpeg/commit/191715f0232c","https://github.com/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323","https://www.vulncheck.com/advisories/ffmpeg-before-8.1.3-hls-demuxer-security-check-bypass-via-parse-playlist"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","description":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-86413","versionConstraint":">= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86413","date":"2026-10-27","epss":0.00319,"percentile":0.24705}],"risk":0.1595,"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."},"relatedVulnerabilities":[]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-27","epss":0.00315,"percentile":0.24264}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-27","epss":0.00315,"percentile":0.24264}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-27","epss":0.00315,"percentile":0.24264}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-27","epss":0.00315,"percentile":0.24264}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"339e7c8af3fbd149","cpes":["cpe:2.3:a:locales:locales:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.39-0ubuntu8.9?arch=all&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-27","epss":0.00315,"percentile":0.24264}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-27","epss":0.00315,"percentile":0.24264}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-87862","versionConstraint":">= 8.11.0, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87862","date":"2026-10-27","epss":0.00314,"percentile":0.24163}],"risk":0.157,"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."},"relatedVulnerabilities":[]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61308","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61308","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61308","date":"2026-10-27","epss":0.0031,"percentile":0.23688}],"risk":0.155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61308"},"relatedVulnerabilities":[{"id":"CVE-2026-61308","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61308","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61308","date":"2026-10-27","epss":0.0031,"percentile":0.23688}],"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61308","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61308","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61308","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61308","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61308","date":"2026-10-27","epss":0.0031,"percentile":0.23688}],"risk":0.155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61308"},"relatedVulnerabilities":[{"id":"CVE-2026-61308","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.8,"impactScore":4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61308","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61308","date":"2026-10-27","epss":0.0031,"percentile":0.23688}],"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61308","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)."}]},{"artifact":{"id":"b904160816bf0fae","cpes":["cpe:2.3:a:xserver-common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver-common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xserver-common","purl":"pkg:deb/ubuntu/xserver-common@2%3A21.1.12-1ubuntu1.8?arch=all&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xserver-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xserver-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56000","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56000","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56000","cwe":"CWE-416","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-56000","date":"2026-10-27","epss":0.00308,"percentile":0.2347}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56000"},"relatedVulnerabilities":[{"id":"CVE-2026-56000","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56000","cwe":"CWE-416","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-56000","date":"2026-10-27","epss":0.00308,"percentile":0.2347}],"urls":["https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043","https://www.openwall.com/lists/oss-security/2026/07/08/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56000","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory."}]},{"artifact":{"id":"670a92a0d828ff64","cpes":["cpe:2.3:a:xvfb:xvfb:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xvfb","purl":"pkg:deb/ubuntu/xvfb@2%3A21.1.12-1ubuntu1.8?arch=amd64&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xvfb/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xvfb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56000","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56000","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56000","cwe":"CWE-416","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-56000","date":"2026-10-27","epss":0.00308,"percentile":0.2347}],"risk":0.154,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56000"},"relatedVulnerabilities":[{"id":"CVE-2026-56000","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56000","cwe":"CWE-416","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-56000","date":"2026-10-27","epss":0.00308,"percentile":0.2347}],"urls":["https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043","https://www.openwall.com/lists/oss-security/2026/07/08/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56000","description":"Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-27","epss":0.00307,"percentile":0.2337}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-27","epss":0.00307,"percentile":0.2337}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-27","epss":0.00307,"percentile":0.2337}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-27","epss":0.00307,"percentile":0.2337}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66039","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-27","epss":0.00307,"percentile":0.2337}],"risk":0.1535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66039"},"relatedVulnerabilities":[{"id":"CVE-2026-66039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66039","cwe":"CWE-122","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-66039","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66039","date":"2026-10-27","epss":0.00307,"percentile":0.2337}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/aafb5c655edc76a753275c383ebb139feb032718","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23631","https://www.vulncheck.com/advisories/ffmpeg-mace6-audio-decoder-heap-out-of-bounds-write-via-caf-file"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66039","description":"FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attackers can craft a CAF file with oversized bytes_per_packet and frames_per_packet values in the desc chunk to trigger an integer overflow in mace_decode_frame() during output sample count computation, resulting in an undersized buffer allocation and heap out-of-bounds write that could enable code execution."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91410","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91410","date":"2026-10-27","epss":0.00306,"percentile":0.23276}],"risk":0.153,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91410"},"relatedVulnerabilities":[{"id":"CVE-2026-91410","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91410","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91410","date":"2026-10-27","epss":0.00306,"percentile":0.23276}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91410","description":"Vulnerability in Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91417","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91417","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91417","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91417","date":"2026-10-27","epss":0.00306,"percentile":0.23276}],"risk":0.153,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91417"},"relatedVulnerabilities":[{"id":"CVE-2026-91417","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91417","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91417","date":"2026-10-27","epss":0.00306,"percentile":0.23276}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91417","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91410","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91410","date":"2026-10-27","epss":0.00306,"percentile":0.23276}],"risk":0.153,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91410"},"relatedVulnerabilities":[{"id":"CVE-2026-91410","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91410","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91410","date":"2026-10-27","epss":0.00306,"percentile":0.23276}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91410","description":"Vulnerability in Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91417","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91417","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91417","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91417","date":"2026-10-27","epss":0.00306,"percentile":0.23276}],"risk":0.153,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91417"},"relatedVulnerabilities":[{"id":"CVE-2026-91417","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91417","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91417","date":"2026-10-27","epss":0.00306,"percentile":0.23276}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91417","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"8ee0d9664ec385d1","cpes":["cpe:2.3:a:golang:go:1.27.1:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.1","type":"go-module","version":"go1.27.1","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.1"},"locations":[{"path":"/usr/local/bin/envsubst","layerID":"sha256:bdc75125180b3e337c84c31f5e78e341420dc3fdd2b77516edf8e3698c094fe0","accessPath":"/usr/local/bin/envsubst","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6809","versionConstraint":"<1.26.10||>=1.27.0-0,<1.27.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.1"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6809","fix":{"state":"fixed","versions":["1.26.10","1.27.3"],"available":[{"date":"2026-10-20","kind":"release","version":"1.26.10"},{"date":"2026-10-20","kind":"release","version":"1.27.3"}]},"cvss":[],"epss":[{"cve":"CVE-2026-111943","date":"2026-10-27","epss":0.00299,"percentile":0.2244}],"risk":0.1495,"urls":["https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/851047","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.\n\nTo defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."},"relatedVulnerabilities":[{"id":"CVE-2026-111943","cvss":[],"epss":[{"cve":"CVE-2026-111943","date":"2026-10-27","epss":0.00299,"percentile":0.2244}],"urls":["https://go.dev/cl/851047","https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek","https://pkg.go.dev/vuln/GO-2026-6809","http://www.openwall.com/lists/oss-security/2026/10/20/29"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111943","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."}]},{"artifact":{"id":"c4980ec93c1d6f9d","cpes":["cpe:2.3:a:golang:go:1.27.2:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.27.2","type":"go-module","version":"go1.27.2","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.27.2"},"locations":[{"path":"/usr/local/bin/rclone","layerID":"sha256:dae90a7ec927c7619bf8c509950e707c7ca0f83d62585bc25cc4ae84b6747eca","accessPath":"/usr/local/bin/rclone","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.27.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6809","versionConstraint":"<1.26.10||>=1.27.0-0,<1.27.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.27.2"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6809","fix":{"state":"fixed","versions":["1.26.10","1.27.3"],"available":[{"date":"2026-10-20","kind":"release","version":"1.26.10"},{"date":"2026-10-20","kind":"release","version":"1.27.3"}]},"cvss":[],"epss":[{"cve":"CVE-2026-111943","date":"2026-10-27","epss":0.00299,"percentile":0.2244}],"risk":0.1495,"urls":["https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/851047","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.\n\nTo defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."},"relatedVulnerabilities":[{"id":"CVE-2026-111943","cvss":[],"epss":[{"cve":"CVE-2026-111943","date":"2026-10-27","epss":0.00299,"percentile":0.2244}],"urls":["https://go.dev/cl/851047","https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek","https://pkg.go.dev/vuln/GO-2026-6809","http://www.openwall.com/lists/oss-security/2026/10/20/29"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111943","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-27","epss":0.00294,"percentile":0.21875}],"risk":0.147,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89156"},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-27","epss":0.00294,"percentile":0.21875}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-10-27","epss":0.00293,"percentile":0.2182}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-10-27","epss":0.00293,"percentile":0.2182}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-10-27","epss":0.00293,"percentile":0.2182}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-10-27","epss":0.00293,"percentile":0.2182}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-10-27","epss":0.00293,"percentile":0.2182}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13858"},"relatedVulnerabilities":[{"id":"CVE-2026-13858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13858","cwe":"CWE-125","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-13858","date":"2026-10-27","epss":0.00293,"percentile":0.2182}],"urls":["https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","https://issues.chromium.org/issues/507090179"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13858","description":"Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)"}]},{"artifact":{"id":"03a1b62b39da5b54","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.2.2-1ubuntu5.24.04.1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/ubuntu/libsndfile1@1.2.2-1ubuntu5.24.04.1?arch=amd64&distro=ubuntu-24.04&upstream=libsndfile","type":"deb","version":"1.2.2-1ubuntu5.24.04.1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","FSFAP","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","NTP","gsm","sun"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109828","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsndfile","version":"1.2.2-1ubuntu5.24.04.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109828","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109828","cwe":"CWE-453","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-109828","cwe":"CWE-457","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-109828","date":"2026-10-27","epss":0.00293,"percentile":0.21818}],"risk":0.1465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109828"},"relatedVulnerabilities":[{"id":"CVE-2026-109828","cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109828","cwe":"CWE-453","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-109828","cwe":"CWE-457","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-109828","date":"2026-10-27","epss":0.00293,"percentile":0.21818}],"urls":["https://github.com/libsndfile/libsndfile/","https://github.com/libsndfile/libsndfile/issues/1169","https://vuldb.com/cve/CVE-2026-109828","https://vuldb.com/submit/1002209","https://vuldb.com/vuln/417466","https://vuldb.com/vuln/417466/cti"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109828","description":"A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-107928","versionConstraint":">= 7.86.0, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-107928","date":"2026-10-27","epss":0.00293,"percentile":0.21698}],"risk":0.1465,"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."},"relatedVulnerabilities":[]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-27","epss":0.00292,"percentile":0.21607}],"risk":0.146,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-27","epss":0.00292,"percentile":0.21607}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-27","epss":0.00292,"percentile":0.21607}],"risk":0.146,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-27","epss":0.00292,"percentile":0.21607}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-65703","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-65703","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-27","epss":0.00292,"percentile":0.21607}],"risk":0.146,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-65703"},"relatedVulnerabilities":[{"id":"CVE-2026-65703","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-65703","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-65703","date":"2026-10-27","epss":0.00292,"percentile":0.21607}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/fd3ee52fab34d98a95b787d0b5ff45685766200c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23773","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-write-in-tdsc-video-decoder"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-65703","description":"FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The tdsc_parse_tdsf() function fails to unreference the existing reference frame before calling av_frame_get_buffer(), causing tdsc_blit() and tdsc_yuv2rgb() to write attacker-controlled pixel data beyond the end of the undersized reference frame buffer, resulting in a process crash and potential code execution."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66338","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66338","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66338","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-66338","date":"2026-10-27","epss":0.00291,"percentile":0.21537}],"risk":0.1455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66338"},"relatedVulnerabilities":[{"id":"CVE-2026-66338","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66338","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-66338","date":"2026-10-27","epss":0.00291,"percentile":0.21537}],"urls":["https://access.redhat.com/security/cve/CVE-2026-66338","https://bugzilla.redhat.com/show_bug.cgi?id=2506950"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66338","description":"A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66338","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66338","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66338","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-66338","date":"2026-10-27","epss":0.00291,"percentile":0.21537}],"risk":0.1455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66338"},"relatedVulnerabilities":[{"id":"CVE-2026-66338","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66338","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-66338","date":"2026-10-27","epss":0.00291,"percentile":0.21537}],"urls":["https://access.redhat.com/security/cve/CVE-2026-66338","https://bugzilla.redhat.com/show_bug.cgi?id=2506950"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66338","description":"A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91451","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91451","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91451","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91451","date":"2026-10-27","epss":0.0029,"percentile":0.21392}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91451"},"relatedVulnerabilities":[{"id":"CVE-2026-91451","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91451","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91451","date":"2026-10-27","epss":0.0029,"percentile":0.21392}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91451","description":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91451","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91451","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91451","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91451","date":"2026-10-27","epss":0.0029,"percentile":0.21392}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91451"},"relatedVulnerabilities":[{"id":"CVE-2026-91451","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91451","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91451","date":"2026-10-27","epss":0.0029,"percentile":0.21392}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91451","description":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91332","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91332","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91332","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91332","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91332"},"relatedVulnerabilities":[{"id":"CVE-2026-91332","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91332","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91332","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91332","description":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91452","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91452","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91452","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91452","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91452"},"relatedVulnerabilities":[{"id":"CVE-2026-91452","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91452","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91452","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91452","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91453","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91453","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91453","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91453","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91453"},"relatedVulnerabilities":[{"id":"CVE-2026-91453","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91453","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91453","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91453","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91332","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91332","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91332","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91332","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91332"},"relatedVulnerabilities":[{"id":"CVE-2026-91332","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91332","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91332","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91332","description":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91452","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91452","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91452","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91452","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91452"},"relatedVulnerabilities":[{"id":"CVE-2026-91452","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91452","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91452","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91452","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91453","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91453","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91453","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91453","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"risk":0.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91453"},"relatedVulnerabilities":[{"id":"CVE-2026-91453","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91453","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91453","date":"2026-10-27","epss":0.0029,"percentile":0.21391}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91453","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91464","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91464","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91464","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91464","date":"2026-10-27","epss":0.00289,"percentile":0.21386}],"risk":0.14450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91464"},"relatedVulnerabilities":[{"id":"CVE-2026-91464","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91464","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91464","date":"2026-10-27","epss":0.00289,"percentile":0.21386}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91464","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91464","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91464","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91464","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91464","date":"2026-10-27","epss":0.00289,"percentile":0.21386}],"risk":0.14450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91464"},"relatedVulnerabilities":[{"id":"CVE-2026-91464","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91464","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91464","date":"2026-10-27","epss":0.00289,"percentile":0.21386}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91464","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83374","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83374","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83374","date":"2026-10-27","epss":0.00289,"percentile":0.21313}],"risk":0.14450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83374"},"relatedVulnerabilities":[{"id":"CVE-2026-83374","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83374","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83374","date":"2026-10-27","epss":0.00289,"percentile":0.21313}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83374","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83374","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83374","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83374","date":"2026-10-27","epss":0.00289,"percentile":0.21313}],"risk":0.14450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83374"},"relatedVulnerabilities":[{"id":"CVE-2026-83374","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83374","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83374","date":"2026-10-27","epss":0.00289,"percentile":0.21313}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83374","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101516","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-101516","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-101516","date":"2026-10-27","epss":0.00281,"percentile":0.205}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101516"},"relatedVulnerabilities":[{"id":"CVE-2026-101516","cvss":[{"type":"Primary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101516","date":"2026-10-27","epss":0.00281,"percentile":0.205}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101516","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101516","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-101516","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-101516","date":"2026-10-27","epss":0.00281,"percentile":0.205}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101516"},"relatedVulnerabilities":[{"id":"CVE-2026-101516","cvss":[{"type":"Primary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101516","date":"2026-10-27","epss":0.00281,"percentile":0.205}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101516","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-27","epss":0.00281,"percentile":0.20468}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-27","epss":0.00281,"percentile":0.20468}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-27","epss":0.00281,"percentile":0.20468}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-27","epss":0.00281,"percentile":0.20468}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"339e7c8af3fbd149","cpes":["cpe:2.3:a:locales:locales:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"locales","purl":"pkg:deb/ubuntu/locales@2.39-0ubuntu8.9?arch=all&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/locales/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/locales/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.conffiles","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/locales.config","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.config"},{"path":"/var/lib/dpkg/info/locales.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.list"},{"path":"/var/lib/dpkg/info/locales.postinst","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.postinst"},{"path":"/var/lib/dpkg/info/locales.postrm","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.postrm"},{"path":"/var/lib/dpkg/info/locales.prerm","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.prerm"},{"path":"/var/lib/dpkg/info/locales.templates","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/locales.templates"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-27","epss":0.00281,"percentile":0.20468}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-27","epss":0.00281,"percentile":0.20468}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94114","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-94114","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-94114","cwe":"CWE-386","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-94114","date":"2026-10-27","epss":0.00279,"percentile":0.20267}],"risk":0.13949999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-94114"},"relatedVulnerabilities":[{"id":"CVE-2026-94114","cvss":[{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94114","cwe":"CWE-386","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-94114","date":"2026-10-27","epss":0.00279,"percentile":0.20267}],"urls":["https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch","https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6","http://www.openwall.com/lists/oss-security/2026/10/07/12"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94114","description":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94114","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-94114","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-94114","cwe":"CWE-386","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-94114","date":"2026-10-27","epss":0.00279,"percentile":0.20267}],"risk":0.13949999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-94114"},"relatedVulnerabilities":[{"id":"CVE-2026-94114","cvss":[{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94114","cwe":"CWE-386","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-94114","date":"2026-10-27","epss":0.00279,"percentile":0.20267}],"urls":["https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch","https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6","http://www.openwall.com/lists/oss-security/2026/10/07/12"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94114","description":"Symbolic name not mapping to correct class.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-70907","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70907","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70907","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-70907","date":"2026-10-27","epss":0.00278,"percentile":0.201}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70907"},"relatedVulnerabilities":[{"id":"CVE-2026-70907","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70907","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-70907","date":"2026-10-27","epss":0.00278,"percentile":0.201}],"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70907","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-70907","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70907","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70907","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-70907","date":"2026-10-27","epss":0.00278,"percentile":0.201}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70907"},"relatedVulnerabilities":[{"id":"CVE-2026-70907","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70907","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-70907","date":"2026-10-27","epss":0.00278,"percentile":0.201}],"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70907","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83368","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83368","date":"2026-10-27","epss":0.00277,"percentile":0.2002}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83368"},"relatedVulnerabilities":[{"id":"CVE-2026-83368","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83368","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83368","date":"2026-10-27","epss":0.00277,"percentile":0.2002}],"urls":["https://www.oracle.com/security-alerts/cspusep2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83368","description":"Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data as well as  unauthorized update, insert or delete access to some of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83368","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83368","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83368","date":"2026-10-27","epss":0.00277,"percentile":0.2002}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83368"},"relatedVulnerabilities":[{"id":"CVE-2026-83368","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83368","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83368","date":"2026-10-27","epss":0.00277,"percentile":0.2002}],"urls":["https://www.oracle.com/security-alerts/cspusep2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83368","description":"Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data as well as  unauthorized update, insert or delete access to some of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87294","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87294","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87294","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87294","date":"2026-10-27","epss":0.00277,"percentile":0.19987}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87294"},"relatedVulnerabilities":[{"id":"CVE-2026-87294","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87294","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87294","date":"2026-10-27","epss":0.00277,"percentile":0.19987}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87294","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87294","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87294","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87294","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87294","date":"2026-10-27","epss":0.00277,"percentile":0.19987}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87294"},"relatedVulnerabilities":[{"id":"CVE-2026-87294","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87294","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87294","date":"2026-10-27","epss":0.00277,"percentile":0.19987}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87294","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-10-27","epss":0.00277,"percentile":0.19975}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-10-27","epss":0.00277,"percentile":0.19975}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-10-27","epss":0.00277,"percentile":0.19975}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-10-27","epss":0.00277,"percentile":0.19975}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36613","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-10-27","epss":0.00277,"percentile":0.19975}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36613"},"relatedVulnerabilities":[{"id":"CVE-2024-36613","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36613","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36613","date":"2026-10-27","epss":0.00277,"percentile":0.19975}],"urls":["https://gist.github.com/1047524396/0f4d90ef87553f772f888223085ac806","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/dxa.c#L125","https://github.com/ffmpeg/ffmpeg/commit/50d8e4f27398fd5778485a827d7a2817921f8540"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36613","description":"FFmpeg n6.1.1 has a vulnerability in the DXA demuxer of the libavformat library allowing for an integer overflow, potentially resulting in a denial-of-service (DoS) condition or other undefined behavior."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102556","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102556","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102556","cwe":"CWE-843","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102556","date":"2026-10-27","epss":0.00274,"percentile":0.19638}],"risk":0.13699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102556"},"relatedVulnerabilities":[{"id":"CVE-2026-102556","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102556","cwe":"CWE-843","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102556","date":"2026-10-27","epss":0.00274,"percentile":0.19638}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/errata/RHSA-2026:84586","https://access.redhat.com/security/cve/CVE-2026-102556","https://bugzilla.redhat.com/show_bug.cgi?id=2543229"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102556","description":"A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102557","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102557","date":"2026-10-27","epss":0.00274,"percentile":0.19638}],"risk":0.13699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102557"},"relatedVulnerabilities":[{"id":"CVE-2026-102557","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102557","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102557","date":"2026-10-27","epss":0.00274,"percentile":0.19638}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/errata/RHSA-2026:84586","https://access.redhat.com/security/cve/CVE-2026-102557","https://bugzilla.redhat.com/show_bug.cgi?id=2543231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102557","description":"A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102556","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102556","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102556","cwe":"CWE-843","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102556","date":"2026-10-27","epss":0.00274,"percentile":0.19638}],"risk":0.13699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102556"},"relatedVulnerabilities":[{"id":"CVE-2026-102556","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102556","cwe":"CWE-843","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102556","date":"2026-10-27","epss":0.00274,"percentile":0.19638}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/errata/RHSA-2026:84586","https://access.redhat.com/security/cve/CVE-2026-102556","https://bugzilla.redhat.com/show_bug.cgi?id=2543229"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102556","description":"A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102557","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102557","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102557","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102557","date":"2026-10-27","epss":0.00274,"percentile":0.19638}],"risk":0.13699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102557"},"relatedVulnerabilities":[{"id":"CVE-2026-102557","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102557","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102557","date":"2026-10-27","epss":0.00274,"percentile":0.19638}],"urls":["https://access.redhat.com/errata/RHSA-2026:83384","https://access.redhat.com/errata/RHSA-2026:83618","https://access.redhat.com/errata/RHSA-2026:84586","https://access.redhat.com/security/cve/CVE-2026-102557","https://bugzilla.redhat.com/show_bug.cgi?id=2543231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102557","description":"A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91462","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91462","date":"2026-10-27","epss":0.00274,"percentile":0.19632}],"risk":0.13699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91462"},"relatedVulnerabilities":[{"id":"CVE-2026-91462","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91462","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91462","date":"2026-10-27","epss":0.00274,"percentile":0.19632}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91462","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91462","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91462","date":"2026-10-27","epss":0.00274,"percentile":0.19632}],"risk":0.13699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91462"},"relatedVulnerabilities":[{"id":"CVE-2026-91462","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91462","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91462","date":"2026-10-27","epss":0.00274,"percentile":0.19632}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91462","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9901","cwe":"CWE-524","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-9901","date":"2026-10-27","epss":0.00453,"percentile":0.39178}],"risk":0.1359,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9901"},"relatedVulnerabilities":[{"id":"CVE-2025-9901","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9901","cwe":"CWE-524","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-9901","date":"2026-10-27","epss":0.00453,"percentile":0.39178}],"urls":["https://access.redhat.com/security/cve/CVE-2025-9901","https://bugzilla.redhat.com/show_bug.cgi?id=2392790","https://gitlab.gnome.org/GNOME/libsoup/-/issues/453"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9901","description":"A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9901","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9901","cwe":"CWE-524","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-9901","date":"2026-10-27","epss":0.00453,"percentile":0.39178}],"risk":0.1359,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9901"},"relatedVulnerabilities":[{"id":"CVE-2025-9901","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9901","cwe":"CWE-524","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-9901","date":"2026-10-27","epss":0.00453,"percentile":0.39178}],"urls":["https://access.redhat.com/security/cve/CVE-2025-9901","https://bugzilla.redhat.com/show_bug.cgi?id=2392790","https://gitlab.gnome.org/GNOME/libsoup/-/issues/453"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9901","description":"A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments."}]},{"artifact":{"id":"c3005cb1b8d81dce","cpes":["cpe:2.3:a:libharfbuzz0b:libharfbuzz0b:8.3.0-2build2:*:*:*:*:*:*:*"],"name":"libharfbuzz0b","purl":"pkg:deb/ubuntu/libharfbuzz0b@8.3.0-2build2?arch=amd64&distro=ubuntu-24.04&upstream=harfbuzz","type":"deb","version":"8.3.0-2build2","language":"","licenses":["Apache-2.0","CC0-1.0","Expat","FSFAP","FSFUL","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","LGPL-2.1","LGPL-2.1+","MIT","Monotype","OFL-1.1","UFL-1.0","Unicode"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libharfbuzz0b/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libharfbuzz0b/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libharfbuzz0b:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libharfbuzz0b:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"harfbuzz"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-22693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"harfbuzz","version":"8.3.0-2build2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-22693","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-10-27","epss":0.00452,"percentile":0.39077}],"risk":0.13559999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-22693"},"relatedVulnerabilities":[{"id":"CVE-2026-22693","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22693","cwe":"CWE-476","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-22693","date":"2026-10-27","epss":0.00452,"percentile":0.39077}],"urls":["https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae","https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww","http://www.openwall.com/lists/oss-security/2026/01/11/1","http://www.openwall.com/lists/oss-security/2026/01/12/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22693","description":"HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-27","epss":0.00269,"percentile":0.18915}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103111"},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-27","epss":0.00269,"percentile":0.18915}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-27","epss":0.00268,"percentile":0.18798}],"risk":0.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89160"},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-27","epss":0.00268,"percentile":0.18798}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91411","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91411","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91411","date":"2026-10-27","epss":0.00267,"percentile":0.18687}],"risk":0.1335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91411"},"relatedVulnerabilities":[{"id":"CVE-2026-91411","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91411","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91411","date":"2026-10-27","epss":0.00267,"percentile":0.18687}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91411","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91411","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91411","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91411","date":"2026-10-27","epss":0.00267,"percentile":0.18687}],"risk":0.1335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91411"},"relatedVulnerabilities":[{"id":"CVE-2026-91411","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91411","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91411","date":"2026-10-27","epss":0.00267,"percentile":0.18687}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91411","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-87863","versionConstraint":">= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.2.0, < 8.14.3||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87863","date":"2026-10-27","epss":0.00266,"percentile":0.18415}],"risk":0.133,"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."},"relatedVulnerabilities":[]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-86412","versionConstraint":">= 8.18.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86412","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"risk":0.133,"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."},"relatedVulnerabilities":[]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-86414","versionConstraint":">= 7.10.8, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86414","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"risk":0.133,"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."},"relatedVulnerabilities":[]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-87861","versionConstraint":">= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87861","date":"2026-10-27","epss":0.00266,"percentile":0.18414}],"risk":0.133,"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."},"relatedVulnerabilities":[]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60589","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60589","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60589","date":"2026-10-27","epss":0.00265,"percentile":0.18328}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60589"},"relatedVulnerabilities":[{"id":"CVE-2026-60589","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60589","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60589","date":"2026-10-27","epss":0.00265,"percentile":0.18328}],"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60589","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60589","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60589","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60589","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60589","date":"2026-10-27","epss":0.00265,"percentile":0.18328}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60589"},"relatedVulnerabilities":[{"id":"CVE-2026-60589","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60589","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60589","date":"2026-10-27","epss":0.00265,"percentile":0.18328}],"urls":["https://www.oracle.com/security-alerts/cspuaug2026.html","https://openjdk.org/groups/vulnerability/advisories/2026-08-18"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60589","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and  21.0.12; Oracle GraalVM Enterprise Edition: 21.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"d89ef5f93ba22208","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-27","epss":0.00265,"percentile":0.18327}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-27","epss":0.00265,"percentile":0.18327}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"dbc0224a08459408","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-27","epss":0.00265,"percentile":0.18327}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-27","epss":0.00265,"percentile":0.18327}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"8213e07a58a8ec78","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-27","epss":0.00265,"percentile":0.18327}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-27","epss":0.00265,"percentile":0.18327}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"16e6be2ba255a19b","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-27","epss":0.00265,"percentile":0.18327}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-27","epss":0.00265,"percentile":0.18327}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"b904160816bf0fae","cpes":["cpe:2.3:a:xserver-common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver-common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xserver-common","purl":"pkg:deb/ubuntu/xserver-common@2%3A21.1.12-1ubuntu1.8?arch=all&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xserver-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xserver-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34001","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34001","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-34001","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34001","date":"2026-10-27","epss":0.00264,"percentile":0.18217}],"risk":0.132,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34001"},"relatedVulnerabilities":[{"id":"CVE-2026-34001","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34001","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-34001","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34001","date":"2026-10-27","epss":0.00264,"percentile":0.18217}],"urls":["https://access.redhat.com/errata/RHSA-2026:10739","https://access.redhat.com/errata/RHSA-2026:11352","https://access.redhat.com/errata/RHSA-2026:11369","https://access.redhat.com/errata/RHSA-2026:11388","https://access.redhat.com/errata/RHSA-2026:11656","https://access.redhat.com/errata/RHSA-2026:11692","https://access.redhat.com/errata/RHSA-2026:13414","https://access.redhat.com/errata/RHSA-2026:19125","https://access.redhat.com/errata/RHSA-2026:19342","https://access.redhat.com/errata/RHSA-2026:19343","https://access.redhat.com/errata/RHSA-2026:19344","https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-34001","https://bugzilla.redhat.com/show_bug.cgi?id=2451109","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34001.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34001","description":"A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system."}]},{"artifact":{"id":"670a92a0d828ff64","cpes":["cpe:2.3:a:xvfb:xvfb:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xvfb","purl":"pkg:deb/ubuntu/xvfb@2%3A21.1.12-1ubuntu1.8?arch=amd64&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xvfb/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xvfb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34001","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34001","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-34001","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34001","date":"2026-10-27","epss":0.00264,"percentile":0.18217}],"risk":0.132,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34001"},"relatedVulnerabilities":[{"id":"CVE-2026-34001","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34001","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-34001","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34001","date":"2026-10-27","epss":0.00264,"percentile":0.18217}],"urls":["https://access.redhat.com/errata/RHSA-2026:10739","https://access.redhat.com/errata/RHSA-2026:11352","https://access.redhat.com/errata/RHSA-2026:11369","https://access.redhat.com/errata/RHSA-2026:11388","https://access.redhat.com/errata/RHSA-2026:11656","https://access.redhat.com/errata/RHSA-2026:11692","https://access.redhat.com/errata/RHSA-2026:13414","https://access.redhat.com/errata/RHSA-2026:19125","https://access.redhat.com/errata/RHSA-2026:19342","https://access.redhat.com/errata/RHSA-2026:19343","https://access.redhat.com/errata/RHSA-2026:19344","https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-34001","https://bugzilla.redhat.com/show_bug.cgi?id=2451109","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34001.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34001","description":"A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system."}]},{"artifact":{"id":"9399a526f720c3e2","cpes":["cpe:2.3:a:libicu74:libicu74:74.2-1ubuntu3.1:*:*:*:*:*:*:*"],"name":"libicu74","purl":"pkg:deb/ubuntu/libicu74@74.2-1ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=icu","type":"deb","version":"74.2-1ubuntu3.1","language":"","licenses":["GPL-3","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu74/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libicu74/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu74:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libicu74:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5222","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"icu","version":"74.2-1ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-5222","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5222","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5222","date":"2026-10-27","epss":0.00439,"percentile":0.37951}],"risk":0.13169999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5222"},"relatedVulnerabilities":[{"id":"CVE-2025-5222","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5222","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5222","date":"2026-10-27","epss":0.00439,"percentile":0.37951}],"urls":["https://access.redhat.com/errata/RHSA-2025:11888","https://access.redhat.com/errata/RHSA-2025:12083","https://access.redhat.com/errata/RHSA-2025:12331","https://access.redhat.com/errata/RHSA-2025:12332","https://access.redhat.com/errata/RHSA-2025:12333","https://access.redhat.com/errata/RHSA-2026:54544","https://access.redhat.com/errata/RHSA-2026:54553","https://access.redhat.com/errata/RHSA-2026:54581","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/security/cve/CVE-2025-5222","https://bugzilla.redhat.com/show_bug.cgi?id=2368600","https://unicode-org.atlassian.net/jira/software/c/projects/ICU/issues/ICU-22957","https://lists.debian.org/debian-lts-announce/2025/06/msg00015.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5222","description":"A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution."}]},{"artifact":{"id":"995fe9e99f20c9b6","cpes":["cpe:2.3:a:libxrender1:libxrender1:1\\:0.9.10-1.1build1:*:*:*:*:*:*:*"],"name":"libxrender1","purl":"pkg:deb/ubuntu/libxrender1@1%3A0.9.10-1.1build1?arch=amd64&distro=ubuntu-24.04&upstream=libxrender","type":"deb","version":"1:0.9.10-1.1build1","language":"","licenses":["HPND-sell-variant"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxrender1/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/libxrender1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxrender1:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/libxrender1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxrender"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88807","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxrender","version":"1:0.9.10-1.1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88807","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-10-27","epss":0.00263,"percentile":0.18042}],"risk":0.1315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88807"},"relatedVulnerabilities":[{"id":"CVE-2026-88807","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88807","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88807","date":"2026-10-27","epss":0.00263,"percentile":0.18042}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88807","description":"A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients."}]},{"artifact":{"id":"85678c5b0a35fafd","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.1-1build1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/ubuntu/libxi6@2%3A1.8.1-1build1?arch=amd64&distro=ubuntu-24.04&upstream=libxi","type":"deb","version":"2:1.8.1-1build1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libxi6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxi","version":"2:1.8.1-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93543","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93543","date":"2026-10-27","epss":0.00262,"percentile":0.17921}],"risk":0.131,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93543"},"relatedVulnerabilities":[{"id":"CVE-2026-93543","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93543","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93543","date":"2026-10-27","epss":0.00262,"percentile":0.17921}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=e2089ab748828273f916bbffd4e65b506aa50fdc"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93543","description":"An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}]},{"artifact":{"id":"85678c5b0a35fafd","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.1-1build1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/ubuntu/libxi6@2%3A1.8.1-1build1?arch=amd64&distro=ubuntu-24.04&upstream=libxi","type":"deb","version":"2:1.8.1-1build1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libxi6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93541","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxi","version":"2:1.8.1-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93541","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93541","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93541","date":"2026-10-27","epss":0.00262,"percentile":0.1792}],"risk":0.131,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93541"},"relatedVulnerabilities":[{"id":"CVE-2026-93541","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93541","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93541","date":"2026-10-27","epss":0.00262,"percentile":0.1792}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=7b6fffd13fd3914e0b39f3a4f131913da7f066e7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93541","description":"An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a"}]},{"artifact":{"id":"85678c5b0a35fafd","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.1-1build1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/ubuntu/libxi6@2%3A1.8.1-1build1?arch=amd64&distro=ubuntu-24.04&upstream=libxi","type":"deb","version":"2:1.8.1-1build1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libxi6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93542","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxi","version":"2:1.8.1-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93542","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93542","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93542","date":"2026-10-27","epss":0.00262,"percentile":0.1792}],"risk":0.131,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93542"},"relatedVulnerabilities":[{"id":"CVE-2026-93542","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93542","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93542","date":"2026-10-27","epss":0.00262,"percentile":0.1792}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=f499944ad595b9bd7e7571c810842244caf150aa"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93542","description":"An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client."}]},{"artifact":{"id":"85678c5b0a35fafd","cpes":["cpe:2.3:a:libxi6:libxi6:2\\:1.8.1-1build1:*:*:*:*:*:*:*"],"name":"libxi6","purl":"pkg:deb/ubuntu/libxi6@2%3A1.8.1-1build1?arch=amd64&distro=ubuntu-24.04&upstream=libxi","type":"deb","version":"2:1.8.1-1build1","language":"","licenses":["sha256:c812f9c54513ae593aab9580b54a4b18219648df7068d49ca1daa47f522ba3fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxi6/copyright","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/usr/share/doc/libxi6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxi6:amd64.md5sums","layerID":"sha256:63422fbe5fa34efe22a2ce17083e7893cb0463af977ddae22840b9fd2cb22eeb","accessPath":"/var/lib/dpkg/info/libxi6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxi"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93544","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxi","version":"2:1.8.1-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93544","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93544","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93544","date":"2026-10-27","epss":0.00262,"percentile":0.1792}],"risk":0.131,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93544"},"relatedVulnerabilities":[{"id":"CVE-2026-93544","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93544","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-93544","date":"2026-10-27","epss":0.00262,"percentile":0.1792}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=a88a341135b79f6ed450f481e4a5d6ba502382af"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93544","description":"An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-27","epss":0.00261,"percentile":0.1784}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-27","epss":0.00261,"percentile":0.1784}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-27","epss":0.00261,"percentile":0.1784}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-27","epss":0.00261,"percentile":0.1784}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75146","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75146","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-27","epss":0.00261,"percentile":0.1784}],"risk":0.1305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75146"},"relatedVulnerabilities":[{"id":"CVE-2026-75146","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75146","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-75146","date":"2026-10-27","epss":0.00261,"percentile":0.1784}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/65b0dab903e5975e036b30ecc58f5935d4f151e0","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24093","https://www.vulncheck.com/advisories/ffmpeg-out-of-bounds-read-in-dash-demuxer-via-dashdec-c"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75146","description":"FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the upper bound before indexing the fragments array, allowing a negative index to be used and causing an out-of-bounds read. A malicious or misconfigured DASH server can trigger this by serving a live manifest with a decreasing startNumber across a manifest refresh."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-10-27","epss":0.00258,"percentile":0.17383}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-10-27","epss":0.00258,"percentile":0.17383}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-10-27","epss":0.00258,"percentile":0.17383}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-10-27","epss":0.00258,"percentile":0.17383}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-10-27","epss":0.00258,"percentile":0.17383}],"risk":0.129,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107698"},"relatedVulnerabilities":[{"id":"CVE-2026-107698","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107698","cwe":"CWE-918","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107698","date":"2026-10-27","epss":0.00258,"percentile":0.17383}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22292","https://github.com/FFmpeg/FFmpeg","https://github.com/FFmpeg/FFmpeg/blob/n7.1.3/libavformat/rtsp.c#L2016","https://github.com/FFmpeg/FFmpeg/commit/2326bc5f69c9","https://github.com/FFmpeg/FFmpeg/commit/7c011995e394","https://github.com/FFmpeg/FFmpeg/commit/ea9e85e54981b8402368d0f21648836d6738f1b1","https://github.com/FFmpeg/FFmpeg/commit/f9aa8729bce1","https://www.vulncheck.com/advisories/ffmpeg-before-7.1.4-and-8.0.2-ssrf-via-rtsp-redirect-handling"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","description":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91400","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91400","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-91400","date":"2026-10-27","epss":0.00257,"percentile":0.17266}],"risk":0.1285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91400"},"relatedVulnerabilities":[{"id":"CVE-2026-91400","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-91400","date":"2026-10-27","epss":0.00257,"percentile":0.17266}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91400","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91400","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91400","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-91400","date":"2026-10-27","epss":0.00257,"percentile":0.17266}],"risk":0.1285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91400"},"relatedVulnerabilities":[{"id":"CVE-2026-91400","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-91400","date":"2026-10-27","epss":0.00257,"percentile":0.17266}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91400","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-92388","versionConstraint":">= 7.21.0, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92388","date":"2026-10-27","epss":0.00257,"percentile":0.1728}],"risk":0.1285,"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."},"relatedVulnerabilities":[]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-92386","versionConstraint":">= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0||>= 8.7.0, < 8.14.3 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"},{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92386","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"risk":0.1285,"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."},"relatedVulnerabilities":[]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.14.3"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-92389","versionConstraint":">= 7.15.0, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, <= 8.22.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92389","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"risk":0.1285,"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."},"relatedVulnerabilities":[]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-92390","versionConstraint":">= 7.20.0, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-92390","date":"2026-10-27","epss":0.00257,"percentile":0.17279}],"risk":0.1285,"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."},"relatedVulnerabilities":[]},{"artifact":{"id":"cd80a8862611238d","cpes":["cpe:2.3:a:coreutils:coreutils:9.4-3ubuntu6.3:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"9.4-3ubuntu6.3","language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"coreutils","version":"9.4-3ubuntu6.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-27","epss":0.00428,"percentile":0.36894}],"risk":0.1284,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2781"},"relatedVulnerabilities":[{"id":"CVE-2016-2781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-27","epss":0.00428,"percentile":0.36894}],"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."}]},{"artifact":{"id":"271cbc4b0386e5d1","cpes":["cpe:2.3:a:login:login:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","type":"deb","version":"1:4.13+dfsg1-4ubuntu3.2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-27","epss":0.00426,"percentile":0.36722}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-27","epss":0.00426,"percentile":0.36722}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"12ce9c7a4baa2c69","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","type":"deb","version":"1:4.13+dfsg1-4ubuntu3.2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-27","epss":0.00426,"percentile":0.36722}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-27","epss":0.00426,"percentile":0.36722}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12548","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12548","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12548","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12548","date":"2026-10-27","epss":0.00254,"percentile":0.16903}],"risk":0.127,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12548"},"relatedVulnerabilities":[{"id":"CVE-2026-12548","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12548","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12548","date":"2026-10-27","epss":0.00254,"percentile":0.16903}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12548","https://bugzilla.redhat.com/show_bug.cgi?id=2489996","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12548","description":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12548","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12548","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12548","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12548","date":"2026-10-27","epss":0.00254,"percentile":0.16903}],"risk":0.127,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12548"},"relatedVulnerabilities":[{"id":"CVE-2026-12548","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12548","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-12548","date":"2026-10-27","epss":0.00254,"percentile":0.16903}],"urls":["https://access.redhat.com/security/cve/CVE-2026-12548","https://bugzilla.redhat.com/show_bug.cgi?id=2489996","https://gitlab.gnome.org/GNOME/libsoup/-/work_items/512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12548","description":"A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91395","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91395","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91395","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91395","date":"2026-10-27","epss":0.00253,"percentile":0.16714}],"risk":0.1265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91395"},"relatedVulnerabilities":[{"id":"CVE-2026-91395","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91395","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91395","date":"2026-10-27","epss":0.00253,"percentile":0.16714}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91395","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91395","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91395","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91395","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91395","date":"2026-10-27","epss":0.00253,"percentile":0.16714}],"risk":0.1265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91395"},"relatedVulnerabilities":[{"id":"CVE-2026-91395","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91395","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-91395","date":"2026-10-27","epss":0.00253,"percentile":0.16714}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91395","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83376","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83376","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83376","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"risk":0.126,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83376"},"relatedVulnerabilities":[{"id":"CVE-2026-83376","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83376","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83376","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83376","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87292","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87292","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87292","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"risk":0.126,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87292"},"relatedVulnerabilities":[{"id":"CVE-2026-87292","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87292","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87292","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87292","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-87367","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"risk":0.126,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87367"},"relatedVulnerabilities":[{"id":"CVE-2026-87367","cvss":[{"type":"Primary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87367","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87367","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-83376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-83376","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-83376","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83376","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"risk":0.126,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-83376"},"relatedVulnerabilities":[{"id":"CVE-2026-83376","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-83376","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-83376","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-83376","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87292","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-87292","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87292","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"risk":0.126,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87292"},"relatedVulnerabilities":[{"id":"CVE-2026-87292","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87292","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87292","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87292","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87367","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-87367","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-87367","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"risk":0.126,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-87367"},"relatedVulnerabilities":[{"id":"CVE-2026-87367","cvss":[{"type":"Primary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-87367","date":"2026-10-27","epss":0.00252,"percentile":0.16555}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87367","description":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-86410","versionConstraint":">= 7.81.0, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-86410","date":"2026-10-27","epss":0.00252,"percentile":0.16577}],"risk":0.126,"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."},"relatedVulnerabilities":[]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107655","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107655","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-10-27","epss":0.00251,"percentile":0.16384}],"risk":0.1255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107655"},"relatedVulnerabilities":[{"id":"CVE-2026-107655","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107655","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107655","date":"2026-10-27","epss":0.00251,"percentile":0.16384}],"urls":["https://access.redhat.com/errata/RHSA-2026:80679","https://access.redhat.com/security/cve/CVE-2026-107655","https://bugzilla.redhat.com/show_bug.cgi?id=2548399","https://github.com/OpenPrinting/cups/commit/12237ad","https://github.com/OpenPrinting/cups/commit/25d6830","https://github.com/OpenPrinting/cups/security/advisories/GHSA-58wv-9ffm-5w78"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107655","description":"A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services."}]},{"artifact":{"id":"b904160816bf0fae","cpes":["cpe:2.3:a:xserver-common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver-common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver_common:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver-common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*","cpe:2.3:a:xserver:xserver_common:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xserver-common","purl":"pkg:deb/ubuntu/xserver-common@2%3A21.1.12-1ubuntu1.8?arch=all&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xserver-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xserver-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xserver-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xserver-common.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34003","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34003","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34003","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-34003","cwe":"CWE-125","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34003","date":"2026-10-27","epss":0.0025,"percentile":0.16205}],"risk":0.125,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34003"},"relatedVulnerabilities":[{"id":"CVE-2026-34003","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34003","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-34003","cwe":"CWE-125","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34003","date":"2026-10-27","epss":0.0025,"percentile":0.16205}],"urls":["https://access.redhat.com/errata/RHSA-2026:10739","https://access.redhat.com/errata/RHSA-2026:11352","https://access.redhat.com/errata/RHSA-2026:11369","https://access.redhat.com/errata/RHSA-2026:11388","https://access.redhat.com/errata/RHSA-2026:11656","https://access.redhat.com/errata/RHSA-2026:11692","https://access.redhat.com/errata/RHSA-2026:13414","https://access.redhat.com/errata/RHSA-2026:19125","https://access.redhat.com/errata/RHSA-2026:19342","https://access.redhat.com/errata/RHSA-2026:19343","https://access.redhat.com/errata/RHSA-2026:19344","https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-34003","https://bugzilla.redhat.com/show_bug.cgi?id=2451113","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34003.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34003","description":"A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible."}]},{"artifact":{"id":"670a92a0d828ff64","cpes":["cpe:2.3:a:xvfb:xvfb:2\\:21.1.12-1ubuntu1.8:*:*:*:*:*:*:*"],"name":"xvfb","purl":"pkg:deb/ubuntu/xvfb@2%3A21.1.12-1ubuntu1.8?arch=amd64&distro=ubuntu-24.04&upstream=xorg-server","type":"deb","version":"2:21.1.12-1ubuntu1.8","language":"","licenses":["sha256:4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/xvfb/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/xvfb/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/xvfb.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/xvfb.list"}],"upstreams":[{"name":"xorg-server"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34003","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"xorg-server","version":"2:21.1.12-1ubuntu1.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34003","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34003","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-34003","cwe":"CWE-125","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34003","date":"2026-10-27","epss":0.0025,"percentile":0.16205}],"risk":0.125,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34003"},"relatedVulnerabilities":[{"id":"CVE-2026-34003","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34003","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-34003","cwe":"CWE-125","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-34003","date":"2026-10-27","epss":0.0025,"percentile":0.16205}],"urls":["https://access.redhat.com/errata/RHSA-2026:10739","https://access.redhat.com/errata/RHSA-2026:11352","https://access.redhat.com/errata/RHSA-2026:11369","https://access.redhat.com/errata/RHSA-2026:11388","https://access.redhat.com/errata/RHSA-2026:11656","https://access.redhat.com/errata/RHSA-2026:11692","https://access.redhat.com/errata/RHSA-2026:13414","https://access.redhat.com/errata/RHSA-2026:19125","https://access.redhat.com/errata/RHSA-2026:19342","https://access.redhat.com/errata/RHSA-2026:19343","https://access.redhat.com/errata/RHSA-2026:19344","https://access.redhat.com/errata/RHSA-2026:20547","https://access.redhat.com/errata/RHSA-2026:20555","https://access.redhat.com/errata/RHSA-2026:20557","https://access.redhat.com/errata/RHSA-2026:20558","https://access.redhat.com/errata/RHSA-2026:20560","https://access.redhat.com/errata/RHSA-2026:20561","https://access.redhat.com/errata/RHSA-2026:20562","https://access.redhat.com/errata/RHSA-2026:20563","https://access.redhat.com/errata/RHSA-2026:20575","https://access.redhat.com/errata/RHSA-2026:20576","https://access.redhat.com/errata/RHSA-2026:20590","https://access.redhat.com/errata/RHSA-2026:21699","https://access.redhat.com/errata/RHSA-2026:21712","https://access.redhat.com/errata/RHSA-2026:21715","https://access.redhat.com/errata/RHSA-2026:21716","https://access.redhat.com/errata/RHSA-2026:21718","https://access.redhat.com/errata/RHSA-2026:21741","https://access.redhat.com/errata/RHSA-2026:21742","https://access.redhat.com/errata/RHSA-2026:22424","https://access.redhat.com/errata/RHSA-2026:22456","https://access.redhat.com/errata/RHSA-2026:23254","https://access.redhat.com/errata/RHSA-2026:23255","https://access.redhat.com/errata/RHSA-2026:23496","https://access.redhat.com/errata/RHSA-2026:24341","https://access.redhat.com/security/cve/CVE-2026-34003","https://bugzilla.redhat.com/show_bug.cgi?id=2451113","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34003.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34003","description":"A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105111","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-105111","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105111","cwe":"CWE-79","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-105111","date":"2026-10-27","epss":0.00248,"percentile":0.16025}],"risk":0.124,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105111"},"relatedVulnerabilities":[{"id":"CVE-2026-105111","cvss":[{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105111","cwe":"CWE-79","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-105111","date":"2026-10-27","epss":0.00248,"percentile":0.16025}],"urls":["https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504.patch","https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6","http://www.openwall.com/lists/oss-security/2026/10/07/13"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105111","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.\n\n\n\nThis only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105111","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-105111","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105111","cwe":"CWE-79","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-105111","date":"2026-10-27","epss":0.00248,"percentile":0.16025}],"risk":0.124,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105111"},"relatedVulnerabilities":[{"id":"CVE-2026-105111","cvss":[{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":2.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105111","cwe":"CWE-79","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-105111","date":"2026-10-27","epss":0.00248,"percentile":0.16025}],"urls":["https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504.patch","https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6","http://www.openwall.com/lists/oss-security/2026/10/07/13"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105111","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.\n\n\n\nThis only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-10-27","epss":0.00247,"percentile":0.15954}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32228"},"relatedVulnerabilities":[{"id":"CVE-2024-32228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-10-27","epss":0.00247,"percentile":0.15954}],"urls":["https://trac.ffmpeg.org/ticket/10951"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32228","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-10-27","epss":0.00247,"percentile":0.15954}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32228"},"relatedVulnerabilities":[{"id":"CVE-2024-32228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-10-27","epss":0.00247,"percentile":0.15954}],"urls":["https://trac.ffmpeg.org/ticket/10951"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32228","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-32228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-32228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-10-27","epss":0.00247,"percentile":0.15954}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-32228"},"relatedVulnerabilities":[{"id":"CVE-2024-32228","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.6,"impactScore":4.8,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32228","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-32228","cwe":"CWE-121","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-32228","date":"2026-10-27","epss":0.00247,"percentile":0.15954}],"urls":["https://trac.ffmpeg.org/ticket/10951"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32228","description":"FFmpeg 7.0 is vulnerable to Buffer Overflow. There is a SEGV at libavcodec/hevcdec.c:2947:22 in hevc_frame_end."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:538812a4b9bd45adaac2b5e5b967daa6999aa44eb110aa32ae7c69702b906475","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-27","epss":0.00247,"percentile":0.15876}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89158"},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-27","epss":0.00247,"percentile":0.15876}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-10-27","epss":0.00246,"percentile":0.15812}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36618"},"relatedVulnerabilities":[{"id":"CVE-2024-36618","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-10-27","epss":0.00246,"percentile":0.15812}],"urls":["https://gist.github.com/1047524396/a148f3679415a6da53ca112eb2ba1523","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/avidec.c#L1699","https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36618","description":"FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-10-27","epss":0.00246,"percentile":0.15812}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36618"},"relatedVulnerabilities":[{"id":"CVE-2024-36618","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-10-27","epss":0.00246,"percentile":0.15812}],"urls":["https://gist.github.com/1047524396/a148f3679415a6da53ca112eb2ba1523","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/avidec.c#L1699","https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36618","description":"FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36618","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-10-27","epss":0.00246,"percentile":0.15812}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36618"},"relatedVulnerabilities":[{"id":"CVE-2024-36618","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36618","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36618","date":"2026-10-27","epss":0.00246,"percentile":0.15812}],"urls":["https://gist.github.com/1047524396/a148f3679415a6da53ca112eb2ba1523","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/avidec.c#L1699","https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857","https://lists.debian.org/debian-lts-announce/2025/02/msg00000.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36618","description":"FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66337","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66337","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66337","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-66337","date":"2026-10-27","epss":0.00246,"percentile":0.15786}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66337"},"relatedVulnerabilities":[{"id":"CVE-2026-66337","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66337","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-66337","date":"2026-10-27","epss":0.00246,"percentile":0.15786}],"urls":["https://access.redhat.com/security/cve/CVE-2026-66337","https://bugzilla.redhat.com/show_bug.cgi?id=2506949"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66337","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66337","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66337","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66337","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-66337","date":"2026-10-27","epss":0.00246,"percentile":0.15786}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66337"},"relatedVulnerabilities":[{"id":"CVE-2026-66337","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66337","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-66337","date":"2026-10-27","epss":0.00246,"percentile":0.15786}],"urls":["https://access.redhat.com/security/cve/CVE-2026-66337","https://bugzilla.redhat.com/show_bug.cgi?id=2506949"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66337","description":"A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory."}]},{"artifact":{"id":"2a0b954fedc8b6d6","cpes":["cpe:2.3:a:libsoup-3.0-0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_0:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-0","purl":"pkg:deb/ubuntu/libsoup-3.0-0@3.4.4-5ubuntu0.9?arch=amd64&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-0/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103399","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103399","date":"2026-10-27","epss":0.00246,"percentile":0.15735}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103399"},"relatedVulnerabilities":[{"id":"CVE-2026-103399","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103399","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103399","date":"2026-10-27","epss":0.00246,"percentile":0.15735}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103399","https://bugzilla.redhat.com/show_bug.cgi?id=2543949"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103399","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling."}]},{"artifact":{"id":"51088df99f960fed","cpes":["cpe:2.3:a:libsoup-3.0-common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0-common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0_common:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup-3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup_3.0:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup-3.0-common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*","cpe:2.3:a:libsoup:libsoup_3.0_common:3.4.4-5ubuntu0.9:*:*:*:*:*:*:*"],"name":"libsoup-3.0-common","purl":"pkg:deb/ubuntu/libsoup-3.0-common@3.4.4-5ubuntu0.9?arch=all&distro=ubuntu-24.04&upstream=libsoup3","type":"deb","version":"3.4.4-5ubuntu0.9","language":"","licenses":["Expat","LGPL-2+","LGPL-2.1","LGPL-2.1+","MPL-2.0","RSA-Other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsoup-3.0-common/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libsoup-3.0-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsoup-3.0-common.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libsoup-3.0-common.list"}],"upstreams":[{"name":"libsoup3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libsoup3","version":"3.4.4-5ubuntu0.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103399","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103399","date":"2026-10-27","epss":0.00246,"percentile":0.15735}],"risk":0.123,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103399"},"relatedVulnerabilities":[{"id":"CVE-2026-103399","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103399","cwe":"CWE-444","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-103399","date":"2026-10-27","epss":0.00246,"percentile":0.15735}],"urls":["https://access.redhat.com/security/cve/CVE-2026-103399","https://bugzilla.redhat.com/show_bug.cgi?id=2543949"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103399","description":"A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling."}]},{"artifact":{"id":"6e731ea0099e92d5","cpes":["cpe:2.3:a:openjdk-21-jdk-headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk-headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk_headless:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jdk-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jdk_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jdk-headless","purl":"pkg:deb/ubuntu/openjdk-21-jdk-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jdk-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jdk-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91333","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91333","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-91333","date":"2026-10-27","epss":0.00245,"percentile":0.15654}],"risk":0.1225,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91333"},"relatedVulnerabilities":[{"id":"CVE-2026-91333","cvss":[{"type":"Primary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-91333","date":"2026-10-27","epss":0.00245,"percentile":0.15654}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91333","description":"Vulnerability in Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"925ff62d771e11f5","cpes":["cpe:2.3:a:openjdk-21-jre-headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre-headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre_headless:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21-jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21_jre:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_21:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-21-jre-headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_21_jre_headless:21.0.12.1\\+1-1\\~24.04.4:*:*:*:*:*:*:*"],"name":"openjdk-21-jre-headless","purl":"pkg:deb/ubuntu/openjdk-21-jre-headless@21.0.12.1%2B1-1~24.04.4?arch=amd64&distro=ubuntu-24.04&upstream=openjdk-21","type":"deb","version":"21.0.12.1+1-1~24.04.4","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-21-jre-headless/copyright","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/usr/share/doc/openjdk-21-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","layerID":"sha256:1dea5ecea94327cbb7a2d2f444793ef04a0481069f0d0459defede494b192762","accessPath":"/var/lib/dpkg/info/openjdk-21-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-21"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91333","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjdk-21","version":"21.0.12.1+1-1~24.04.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91333","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-91333","date":"2026-10-27","epss":0.00245,"percentile":0.15654}],"risk":0.1225,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91333"},"relatedVulnerabilities":[{"id":"CVE-2026-91333","cvss":[{"type":"Primary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-91333","date":"2026-10-27","epss":0.00245,"percentile":0.15654}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91333","description":"Vulnerability in Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"1291f75ad3df7883","cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:generic/curl@8.22.0","type":"binary","version":"8.22.0","language":"","licenses":[],"locations":[{"path":"/usr/bin/curl","layerID":"sha256:8e96b264320274b13ba6eb30c0b686010f3ad643244ff6d4c3a09aa279bfa8b7","accessPath":"/usr/bin/curl","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0"},"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-87865","versionConstraint":">= 7.69.1, < 8.14.3||>= 8.15.0, < 8.16.2||>= 8.17.0, < 8.20.2||>= 8.21.0, < 8.23.0 (unknown)"},"matcher":"stock-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:8.22.0:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"8.22.0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.14.3","8.16.2","8.20.2","8.23.0"],"available":[{"date":"2026-10-28","kind":"first-observed","version":"8.14.3"},{"date":"2026-10-28","kind":"first-observed","version":"8.16.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.20.2"},{"date":"2026-10-28","kind":"first-observed","version":"8.23.0"}]},"cvss":[],"epss":[{"cve":"CVE-2026-87865","date":"2026-10-27","epss":0.00244,"percentile":0.15474}],"risk":0.122,"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"Unknown","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."},"relatedVulnerabilities":[]},{"artifact":{"id":"57ae2119a8593e71","cpes":["cpe:2.3:a:libopenjp2-7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2-7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2_7:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2-7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:libopenjp2:libopenjp2_7:2.5.0-2ubuntu0.5:*:*:*:*:*:*:*"],"name":"libopenjp2-7","purl":"pkg:deb/ubuntu/libopenjp2-7@2.5.0-2ubuntu0.5?arch=amd64&distro=ubuntu-24.04&upstream=openjpeg2","type":"deb","version":"2.5.0-2ubuntu0.5","language":"","licenses":["BSD-2","BSD-3","LIBPNG","LIBTIFF","LIBTIFF-GLARSON","LIBTIFF-PIXAR","MIT","ZLIB","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libopenjp2-7/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libopenjp2-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libopenjp2-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjpeg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-39328","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openjpeg2","version":"2.5.0-2ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-39328","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-39328","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39328","date":"2026-10-27","epss":0.00242,"percentile":0.15326}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-39328"},"relatedVulnerabilities":[{"id":"CVE-2023-39328","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-39328","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2023-39328","date":"2026-10-27","epss":0.00242,"percentile":0.15326}],"urls":["https://access.redhat.com/security/cve/CVE-2023-39328","https://bugzilla.redhat.com/show_bug.cgi?id=2219236","https://github.com/uclouvain/openjpeg/issues/1476","https://github.com/uclouvain/openjpeg/pull/1470","https://github.com/uclouvain/openjpeg/pull/1471"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-39328","description":"A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-27","epss":0.00242,"percentile":0.15284}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66038"},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-27","epss":0.00242,"percentile":0.15284}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-27","epss":0.00242,"percentile":0.15284}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66038"},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-27","epss":0.00242,"percentile":0.15284}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-66038","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-66038","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-27","epss":0.00242,"percentile":0.15284}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-66038"},"relatedVulnerabilities":[{"id":"CVE-2026-66038","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-66038","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-66038","date":"2026-10-27","epss":0.00242,"percentile":0.15284}],"urls":["https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e7cbfd1c507b57a806a5825b87d609963e862c8c","https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23626","https://www.vulncheck.com/advisories/ffmpeg-lcl-zlib-video-decoder-information-disclosure-via-lcldec-c"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-66038","description":"FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes than the expected frame size. The zlib_decomp() function in lcldec.c treats short decompression as non-fatal and continues to the RGB24 conversion path, which copies a full frame's worth of rows from the allocation buffer using original frame dimensions, causing uninitialized heap contents including pointer-derived allocator bytes to be copied into the attacker-observable AVFrame output and potentially defeating ASLR in long-lived media processing services."}]},{"artifact":{"id":"52bcf6f4517919c7","cpes":["cpe:2.3:a:x11vnc:x11vnc:0.9.16-10:*:*:*:*:*:*:*"],"name":"x11vnc","purl":"pkg:deb/ubuntu/x11vnc@0.9.16-10?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.9.16-10","language":"","licenses":["GPL-2","GPL-2.0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/x11vnc/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/x11vnc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/x11vnc.list","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/x11vnc.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-44988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"x11vnc","version":"0.9.16-10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44988","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44988","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44988","date":"2026-10-27","epss":0.00242,"percentile":0.15264}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44988"},"relatedVulnerabilities":[{"id":"CVE-2026-44988","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44988","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44988","date":"2026-10-27","epss":0.00242,"percentile":0.15264}],"urls":["https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1","https://github.com/LibVNC/libvncserver/security/advisories/GHSA-jcc5-8wj4-7c58"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44988","description":"LibVNCClient is a library for easy implementation of a VNC client. In 0.9.15 and earlier, LibVNCClient's Tight encoding decoder uses fixed-size 2048-pixel scratch buffers for the Gradient filter, but it does not reject Tight rectangles whose width is larger than 2048 pixels. A malicious VNC server can send a crafted FramebufferUpdate rectangle using Tight encoding with NoZlib | ExplicitFilter and the Gradient filter. When a LibVNCClient-based client connects, the client processes the server-controlled rectangle width and writes beyond fixed-size Gradient buffers. This vulnerability is fixed with commit 5b270544b85233668b98161323297d418a8f5fd1."}]},{"artifact":{"id":"f822ee7232eec3f9","cpes":["cpe:2.3:a:libavcodec60:libavcodec60:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavcodec60","purl":"pkg:deb/ubuntu/libavcodec60@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavcodec60/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavcodec60/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavcodec60:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36617","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36617","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-10-27","epss":0.00242,"percentile":0.15243}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36617"},"relatedVulnerabilities":[{"id":"CVE-2024-36617","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-10-27","epss":0.00242,"percentile":0.15243}],"urls":["https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274","https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}]},{"artifact":{"id":"6a084fa77d3c7a0b","cpes":["cpe:2.3:a:libavutil58:libavutil58:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libavutil58","purl":"pkg:deb/ubuntu/libavutil58@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libavutil58/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libavutil58/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libavutil58:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36617","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36617","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-10-27","epss":0.00242,"percentile":0.15243}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36617"},"relatedVulnerabilities":[{"id":"CVE-2024-36617","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-10-27","epss":0.00242,"percentile":0.15243}],"urls":["https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274","https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}]},{"artifact":{"id":"6b229d538d6dd9fb","cpes":["cpe:2.3:a:libswresample4:libswresample4:7\\:6.1.1-3ubuntu5:*:*:*:*:*:*:*"],"name":"libswresample4","purl":"pkg:deb/ubuntu/libswresample4@7%3A6.1.1-3ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=ffmpeg","type":"deb","version":"7:6.1.1-3ubuntu5","language":"","licenses":["BSD-1-clause","BSD-2-clause","BSD-3-clause","BSL","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","IJG","ISC","LGPL-2+","LGPL-2.1","LGPL-2.1+","Sundry","Zlib","man-page","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libswresample4/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libswresample4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libswresample4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ffmpeg"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-36617","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"ffmpeg","version":"7:6.1.1-3ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-36617","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-10-27","epss":0.00242,"percentile":0.15243}],"risk":0.121,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-36617"},"relatedVulnerabilities":[{"id":"CVE-2024-36617","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-36617","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-36617","date":"2026-10-27","epss":0.00242,"percentile":0.15243}],"urls":["https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df","https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274","https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-36617","description":"FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder."}]},{"artifact":{"id":"446bdf2f3d1206f1","cpes":["cpe:2.3:a:libcups2t64:libcups2t64:2.4.7-1.2ubuntu7.14:*:*:*:*:*:*:*"],"name":"libcups2t64","purl":"pkg:deb/ubuntu/libcups2t64@2.4.7-1.2ubuntu7.14?arch=amd64&distro=ubuntu-24.04&upstream=cups","type":"deb","version":"2.4.7-1.2ubuntu7.14","language":"","licenses":["Apache-2.0","Apache-2.0-with-GPL2-LGPL2-Exception","BSD-2-Clause","FSFUL","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:a6267e74b22d1800a162cabd11d64c4d5c27a8da02819c8b45f254e919041efe","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcups2t64/copyright","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/usr/share/doc/libcups2t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","layerID":"sha256:8995daca04b2f7516dcb60c6166d0cb0980e5b67ea4d24fae1a1e9d5d7c4360c","accessPath":"/var/lib/dpkg/info/libcups2t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cups"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cups","version":"2.4.7-1.2ubuntu7.14"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107886","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-10-27","epss":0.00241,"percentile":0.15185}],"risk":0.1205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107886"},"relatedVulnerabilities":[{"id":"CVE-2026-107886","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.3,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107886","cwe":"CWE-415","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-107886","date":"2026-10-27","epss":0.00241,"percentile":0.15185}],"urls":["https://github.com/OpenPrinting/cups/security/advisories/GHSA-pwg4-pv39-8c22"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107886","description":"OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges."}]}],"grade":"F","score":"0.00","as_of":"2026-10-29T03:02:56.931Z","grype_db_version":"2026-10-28T06:23:30.000Z"}