{"grype_matches":[{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-10126","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2018-10126","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-10","epss":0.01829,"percentile":0.78246}],"risk":0.5487,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-10126"},"relatedVulnerabilities":[{"id":"CVE-2018-10126","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10126","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10126","date":"2026-10-10","epss":0.01829,"percentile":0.78246}],"urls":["http://bugzilla.maptools.org/show_bug.cgi?id=2786","https://gitlab.com/libtiff/libtiff/-/issues/128","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10126","description":"ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63292","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63292","cwe":"CWE-121","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63292","date":"2026-10-10","epss":0.00876,"percentile":0.57799}],"risk":0.438,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63292"},"relatedVulnerabilities":[{"id":"CVE-2026-63292","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63292","cwe":"CWE-121","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63292","date":"2026-10-10","epss":0.00876,"percentile":0.57799}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63292","description":"Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63292","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63292","cwe":"CWE-121","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63292","date":"2026-10-10","epss":0.00876,"percentile":0.57799}],"risk":0.438,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63292"},"relatedVulnerabilities":[{"id":"CVE-2026-63292","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63292","cwe":"CWE-121","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63292","date":"2026-10-10","epss":0.00876,"percentile":0.57799}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63292","description":"Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63292","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63292","cwe":"CWE-121","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63292","date":"2026-10-10","epss":0.00876,"percentile":0.57799}],"risk":0.438,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63292"},"relatedVulnerabilities":[{"id":"CVE-2026-63292","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63292","cwe":"CWE-121","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63292","date":"2026-10-10","epss":0.00876,"percentile":0.57799}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63292","description":"Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63292","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63292","cwe":"CWE-121","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63292","date":"2026-10-10","epss":0.00876,"percentile":0.57799}],"risk":0.438,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63292"},"relatedVulnerabilities":[{"id":"CVE-2026-63292","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63292","cwe":"CWE-121","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63292","date":"2026-10-10","epss":0.00876,"percentile":0.57799}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63292","description":"Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"5d668b4eb9cdb47a","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-10","epss":0.0063,"percentile":0.4866}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-10","epss":0.0063,"percentile":0.4866}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"bc00ecb2bdfc2b6f","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-10","epss":0.0063,"percentile":0.4866}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-10","epss":0.0063,"percentile":0.4866}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"bdd817d23e512645","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-10","epss":0.0063,"percentile":0.4866}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-10","epss":0.0063,"percentile":0.4866}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"c9080c1b63d1cc8f","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.6:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.6?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.6","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-10","epss":0.0063,"percentile":0.4866}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-10","epss":0.0063,"percentile":0.4866}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56449","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56449","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56449","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56449","date":"2026-10-10","epss":0.00612,"percentile":0.47768}],"risk":0.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56449"},"relatedVulnerabilities":[{"id":"CVE-2026-56449","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56449","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56449","date":"2026-10-10","epss":0.00612,"percentile":0.47768}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56449","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56449","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56449","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56449","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56449","date":"2026-10-10","epss":0.00612,"percentile":0.47768}],"risk":0.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56449"},"relatedVulnerabilities":[{"id":"CVE-2026-56449","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56449","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56449","date":"2026-10-10","epss":0.00612,"percentile":0.47768}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56449","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56449","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56449","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56449","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56449","date":"2026-10-10","epss":0.00612,"percentile":0.47768}],"risk":0.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56449"},"relatedVulnerabilities":[{"id":"CVE-2026-56449","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56449","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56449","date":"2026-10-10","epss":0.00612,"percentile":0.47768}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56449","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56449","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56449","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56449","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56449","date":"2026-10-10","epss":0.00612,"percentile":0.47768}],"risk":0.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56449"},"relatedVulnerabilities":[{"id":"CVE-2026-56449","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56449","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56449","date":"2026-10-10","epss":0.00612,"percentile":0.47768}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56449","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48005","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48005","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48005","cwe":"CWE-306","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-48005","date":"2026-10-10","epss":0.00606,"percentile":0.4744}],"risk":0.303,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48005"},"relatedVulnerabilities":[{"id":"CVE-2026-48005","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48005","cwe":"CWE-306","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-48005","date":"2026-10-10","epss":0.00606,"percentile":0.4744}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/15"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48005","description":"Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48005","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48005","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48005","cwe":"CWE-306","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-48005","date":"2026-10-10","epss":0.00606,"percentile":0.4744}],"risk":0.303,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48005"},"relatedVulnerabilities":[{"id":"CVE-2026-48005","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48005","cwe":"CWE-306","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-48005","date":"2026-10-10","epss":0.00606,"percentile":0.4744}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/15"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48005","description":"Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48005","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48005","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48005","cwe":"CWE-306","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-48005","date":"2026-10-10","epss":0.00606,"percentile":0.4744}],"risk":0.303,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48005"},"relatedVulnerabilities":[{"id":"CVE-2026-48005","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48005","cwe":"CWE-306","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-48005","date":"2026-10-10","epss":0.00606,"percentile":0.4744}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/15"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48005","description":"Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48005","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48005","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48005","cwe":"CWE-306","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-48005","date":"2026-10-10","epss":0.00606,"percentile":0.4744}],"risk":0.303,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48005"},"relatedVulnerabilities":[{"id":"CVE-2026-48005","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48005","cwe":"CWE-306","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-48005","date":"2026-10-10","epss":0.00606,"percentile":0.4744}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/15"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48005","description":"Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck .\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-79768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-79768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-79768","cwe":"CWE-55","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-79768","date":"2026-10-10","epss":0.0059,"percentile":0.46635}],"risk":0.295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-79768"},"relatedVulnerabilities":[{"id":"CVE-2026-79768","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-79768","cwe":"CWE-55","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-79768","date":"2026-10-10","epss":0.0059,"percentile":0.46635}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-79768","description":"Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-79768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-79768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-79768","cwe":"CWE-55","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-79768","date":"2026-10-10","epss":0.0059,"percentile":0.46635}],"risk":0.295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-79768"},"relatedVulnerabilities":[{"id":"CVE-2026-79768","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-79768","cwe":"CWE-55","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-79768","date":"2026-10-10","epss":0.0059,"percentile":0.46635}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-79768","description":"Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-79768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-79768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-79768","cwe":"CWE-55","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-79768","date":"2026-10-10","epss":0.0059,"percentile":0.46635}],"risk":0.295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-79768"},"relatedVulnerabilities":[{"id":"CVE-2026-79768","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-79768","cwe":"CWE-55","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-79768","date":"2026-10-10","epss":0.0059,"percentile":0.46635}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-79768","description":"Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-79768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-79768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-79768","cwe":"CWE-55","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-79768","date":"2026-10-10","epss":0.0059,"percentile":0.46635}],"risk":0.295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-79768"},"relatedVulnerabilities":[{"id":"CVE-2026-79768","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-79768","cwe":"CWE-55","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-79768","date":"2026-10-10","epss":0.0059,"percentile":0.46635}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/29"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-79768","description":"Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91768"},"relatedVulnerabilities":[{"id":"CVE-2026-91768","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91768","cwe":"CWE-1023","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91768","date":"2026-10-10","epss":0.00561,"percentile":0.44998}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91768","description":"The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77214","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-77214","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-10","epss":0.00549,"percentile":0.44295}],"risk":0.2745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77214"},"relatedVulnerabilities":[{"id":"CVE-2026-77214","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77214","cwe":"CWE-125","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-77214","date":"2026-10-10","epss":0.00549,"percentile":0.44295}],"urls":["https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","https://github.com/libexpat/libexpat/pull/1393","https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-58415","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58415","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58415","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-58415","date":"2026-10-10","epss":0.00533,"percentile":0.43304}],"risk":0.26649999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58415"},"relatedVulnerabilities":[{"id":"CVE-2026-58415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58415","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-58415","date":"2026-10-10","epss":0.00533,"percentile":0.43304}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/20"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58415","description":"Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58415","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58415","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58415","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-58415","date":"2026-10-10","epss":0.00533,"percentile":0.43304}],"risk":0.26649999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58415"},"relatedVulnerabilities":[{"id":"CVE-2026-58415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58415","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-58415","date":"2026-10-10","epss":0.00533,"percentile":0.43304}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/20"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58415","description":"Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58415","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58415","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58415","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-58415","date":"2026-10-10","epss":0.00533,"percentile":0.43304}],"risk":0.26649999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58415"},"relatedVulnerabilities":[{"id":"CVE-2026-58415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58415","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-58415","date":"2026-10-10","epss":0.00533,"percentile":0.43304}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/20"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58415","description":"Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-58415","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-58415","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-58415","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-58415","date":"2026-10-10","epss":0.00533,"percentile":0.43304}],"risk":0.26649999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-58415"},"relatedVulnerabilities":[{"id":"CVE-2026-58415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58415","cwe":"CWE-552","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-58415","date":"2026-10-10","epss":0.00533,"percentile":0.43304}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/20"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58415","description":"Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91765","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91765"},"relatedVulnerabilities":[{"id":"CVE-2026-91765","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91765","cwe":"CWE-674","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91765","date":"2026-10-10","epss":0.00516,"percentile":0.42187}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-rgrp-mwpx-f6rm"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91765","description":"cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63718","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63718","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63718","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63718","date":"2026-10-10","epss":0.00499,"percentile":0.40884}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63718"},"relatedVulnerabilities":[{"id":"CVE-2026-63718","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63718","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63718","date":"2026-10-10","epss":0.00499,"percentile":0.40884}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/26"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63718","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.68."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63718","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63718","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63718","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63718","date":"2026-10-10","epss":0.00499,"percentile":0.40884}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63718"},"relatedVulnerabilities":[{"id":"CVE-2026-63718","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63718","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63718","date":"2026-10-10","epss":0.00499,"percentile":0.40884}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/26"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63718","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.68."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63718","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63718","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63718","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63718","date":"2026-10-10","epss":0.00499,"percentile":0.40884}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63718"},"relatedVulnerabilities":[{"id":"CVE-2026-63718","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63718","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63718","date":"2026-10-10","epss":0.00499,"percentile":0.40884}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/26"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63718","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.68."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63718","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63718","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63718","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63718","date":"2026-10-10","epss":0.00499,"percentile":0.40884}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63718"},"relatedVulnerabilities":[{"id":"CVE-2026-63718","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63718","cwe":"CWE-444","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63718","date":"2026-10-10","epss":0.00499,"percentile":0.40884}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/26"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63718","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.68."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-56153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56153","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56153","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56153","date":"2026-10-10","epss":0.00498,"percentile":0.40842}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56153"},"relatedVulnerabilities":[{"id":"CVE-2026-56153","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56153","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56153","date":"2026-10-10","epss":0.00498,"percentile":0.40842}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56153","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56153","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56153","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56153","date":"2026-10-10","epss":0.00498,"percentile":0.40842}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56153"},"relatedVulnerabilities":[{"id":"CVE-2026-56153","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56153","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56153","date":"2026-10-10","epss":0.00498,"percentile":0.40842}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56153","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56153","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56153","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56153","date":"2026-10-10","epss":0.00498,"percentile":0.40842}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56153"},"relatedVulnerabilities":[{"id":"CVE-2026-56153","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56153","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56153","date":"2026-10-10","epss":0.00498,"percentile":0.40842}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56153","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-56153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-56153","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-56153","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56153","date":"2026-10-10","epss":0.00498,"percentile":0.40842}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-56153"},"relatedVulnerabilities":[{"id":"CVE-2026-56153","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56153","cwe":"CWE-787","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-56153","date":"2026-10-10","epss":0.00498,"percentile":0.40842}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56153","description":"Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-73637","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73637","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-73637","cwe":"CWE-416","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73637","date":"2026-10-10","epss":0.00484,"percentile":0.39822}],"risk":0.242,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73637"},"relatedVulnerabilities":[{"id":"CVE-2026-73637","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73637","cwe":"CWE-416","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73637","date":"2026-10-10","epss":0.00484,"percentile":0.39822}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/28"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73637","description":"Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-73637","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73637","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-73637","cwe":"CWE-416","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73637","date":"2026-10-10","epss":0.00484,"percentile":0.39822}],"risk":0.242,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73637"},"relatedVulnerabilities":[{"id":"CVE-2026-73637","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73637","cwe":"CWE-416","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73637","date":"2026-10-10","epss":0.00484,"percentile":0.39822}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/28"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73637","description":"Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-73637","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73637","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-73637","cwe":"CWE-416","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73637","date":"2026-10-10","epss":0.00484,"percentile":0.39822}],"risk":0.242,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73637"},"relatedVulnerabilities":[{"id":"CVE-2026-73637","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73637","cwe":"CWE-416","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73637","date":"2026-10-10","epss":0.00484,"percentile":0.39822}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/28"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73637","description":"Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-73637","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73637","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-73637","cwe":"CWE-416","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73637","date":"2026-10-10","epss":0.00484,"percentile":0.39822}],"risk":0.242,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73637"},"relatedVulnerabilities":[{"id":"CVE-2026-73637","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73637","cwe":"CWE-416","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73637","date":"2026-10-10","epss":0.00484,"percentile":0.39822}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/28"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73637","description":"Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63686","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63686","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63686","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63686","date":"2026-10-10","epss":0.00478,"percentile":0.39363}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63686"},"relatedVulnerabilities":[{"id":"CVE-2026-63686","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63686","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63686","date":"2026-10-10","epss":0.00478,"percentile":0.39363}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/25"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63686","description":"A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63686","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63686","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63686","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63686","date":"2026-10-10","epss":0.00478,"percentile":0.39363}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63686"},"relatedVulnerabilities":[{"id":"CVE-2026-63686","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63686","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63686","date":"2026-10-10","epss":0.00478,"percentile":0.39363}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/25"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63686","description":"A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63686","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63686","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63686","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63686","date":"2026-10-10","epss":0.00478,"percentile":0.39363}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63686"},"relatedVulnerabilities":[{"id":"CVE-2026-63686","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63686","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63686","date":"2026-10-10","epss":0.00478,"percentile":0.39363}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/25"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63686","description":"A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63686","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63686","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63686","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63686","date":"2026-10-10","epss":0.00478,"percentile":0.39363}],"risk":0.23900000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63686"},"relatedVulnerabilities":[{"id":"CVE-2026-63686","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63686","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63686","date":"2026-10-10","epss":0.00478,"percentile":0.39363}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/25"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63686","description":"A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63045","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63045","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63045","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63045","date":"2026-10-10","epss":0.00472,"percentile":0.38956}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63045"},"relatedVulnerabilities":[{"id":"CVE-2026-63045","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63045","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63045","date":"2026-10-10","epss":0.00472,"percentile":0.38956}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/23"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63045","description":"Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63045","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63045","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63045","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63045","date":"2026-10-10","epss":0.00472,"percentile":0.38956}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63045"},"relatedVulnerabilities":[{"id":"CVE-2026-63045","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63045","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63045","date":"2026-10-10","epss":0.00472,"percentile":0.38956}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/23"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63045","description":"Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63045","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63045","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63045","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63045","date":"2026-10-10","epss":0.00472,"percentile":0.38956}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63045"},"relatedVulnerabilities":[{"id":"CVE-2026-63045","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63045","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63045","date":"2026-10-10","epss":0.00472,"percentile":0.38956}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/23"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63045","description":"Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63045","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63045","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63045","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63045","date":"2026-10-10","epss":0.00472,"percentile":0.38956}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63045"},"relatedVulnerabilities":[{"id":"CVE-2026-63045","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63045","cwe":"CWE-284","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-63045","date":"2026-10-10","epss":0.00472,"percentile":0.38956}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/23"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63045","description":"Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42356","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-42356","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42356","cwe":"CWE-430","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42356","date":"2026-10-10","epss":0.0047,"percentile":0.38749}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42356"},"relatedVulnerabilities":[{"id":"CVE-2026-42356","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42356","cwe":"CWE-430","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42356","date":"2026-10-10","epss":0.0047,"percentile":0.38749}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/11"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42356","description":"Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.60 through 2.4.68."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42356","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-42356","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42356","cwe":"CWE-430","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42356","date":"2026-10-10","epss":0.0047,"percentile":0.38749}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42356"},"relatedVulnerabilities":[{"id":"CVE-2026-42356","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42356","cwe":"CWE-430","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42356","date":"2026-10-10","epss":0.0047,"percentile":0.38749}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/11"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42356","description":"Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.60 through 2.4.68."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42356","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-42356","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42356","cwe":"CWE-430","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42356","date":"2026-10-10","epss":0.0047,"percentile":0.38749}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42356"},"relatedVulnerabilities":[{"id":"CVE-2026-42356","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42356","cwe":"CWE-430","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42356","date":"2026-10-10","epss":0.0047,"percentile":0.38749}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/11"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42356","description":"Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.60 through 2.4.68."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42356","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-42356","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42356","cwe":"CWE-430","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42356","date":"2026-10-10","epss":0.0047,"percentile":0.38749}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42356"},"relatedVulnerabilities":[{"id":"CVE-2026-42356","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42356","cwe":"CWE-430","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42356","date":"2026-10-10","epss":0.0047,"percentile":0.38749}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/11"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42356","description":"Deployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as CGI and executed. The target must already be in a directory enabled for CGI and have no other extension understood by mod_mime.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.60 through 2.4.68."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-46729","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46729","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46729","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-46729","date":"2026-10-10","epss":0.00468,"percentile":0.38628}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46729"},"relatedVulnerabilities":[{"id":"CVE-2026-46729","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46729","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-46729","date":"2026-10-10","epss":0.00468,"percentile":0.38628}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46729","description":"NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46729","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46729","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46729","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-46729","date":"2026-10-10","epss":0.00468,"percentile":0.38628}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46729"},"relatedVulnerabilities":[{"id":"CVE-2026-46729","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46729","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-46729","date":"2026-10-10","epss":0.00468,"percentile":0.38628}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46729","description":"NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46729","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46729","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46729","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-46729","date":"2026-10-10","epss":0.00468,"percentile":0.38628}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46729"},"relatedVulnerabilities":[{"id":"CVE-2026-46729","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46729","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-46729","date":"2026-10-10","epss":0.00468,"percentile":0.38628}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46729","description":"NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46729","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46729","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46729","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-46729","date":"2026-10-10","epss":0.00468,"percentile":0.38628}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46729"},"relatedVulnerabilities":[{"id":"CVE-2026-46729","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46729","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-46729","date":"2026-10-10","epss":0.00468,"percentile":0.38628}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46729","description":"NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-93546","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93546","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93546","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-93546","date":"2026-10-10","epss":0.00436,"percentile":0.36002}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93546"},"relatedVulnerabilities":[{"id":"CVE-2026-93546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93546","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-93546","date":"2026-10-10","epss":0.00436,"percentile":0.36002}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93546","description":"Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93546","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93546","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93546","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-93546","date":"2026-10-10","epss":0.00436,"percentile":0.36002}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93546"},"relatedVulnerabilities":[{"id":"CVE-2026-93546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93546","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-93546","date":"2026-10-10","epss":0.00436,"percentile":0.36002}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93546","description":"Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93546","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93546","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93546","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-93546","date":"2026-10-10","epss":0.00436,"percentile":0.36002}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93546"},"relatedVulnerabilities":[{"id":"CVE-2026-93546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93546","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-93546","date":"2026-10-10","epss":0.00436,"percentile":0.36002}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93546","description":"Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93546","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93546","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93546","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-93546","date":"2026-10-10","epss":0.00436,"percentile":0.36002}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93546"},"relatedVulnerabilities":[{"id":"CVE-2026-93546","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93546","cwe":"CWE-190","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-93546","date":"2026-10-10","epss":0.00436,"percentile":0.36002}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93546","description":"Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12912","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12912","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-10","epss":0.00433,"percentile":0.35641}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12912"},"relatedVulnerabilities":[{"id":"CVE-2026-12912","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-12912","cwe":"CWE-122","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12912","date":"2026-10-10","epss":0.00433,"percentile":0.35641}],"urls":["https://access.redhat.com/errata/RHSA-2026:34890","https://access.redhat.com/errata/RHSA-2026:41892","https://access.redhat.com/errata/RHSA-2026:42668","https://access.redhat.com/errata/RHSA-2026:47183","https://access.redhat.com/errata/RHSA-2026:47184","https://access.redhat.com/errata/RHSA-2026:49671","https://access.redhat.com/errata/RHSA-2026:50774","https://access.redhat.com/errata/RHSA-2026:54638","https://access.redhat.com/errata/RHSA-2026:54640","https://access.redhat.com/errata/RHSA-2026:54642","https://access.redhat.com/errata/RHSA-2026:58545","https://access.redhat.com/errata/RHSA-2026:58553","https://access.redhat.com/errata/RHSA-2026:58554","https://access.redhat.com/errata/RHSA-2026:58556","https://access.redhat.com/errata/RHSA-2026:61657","https://access.redhat.com/errata/RHSA-2026:69292","https://access.redhat.com/errata/RHSA-2026:73909","https://access.redhat.com/errata/RHSA-2026:73959","https://access.redhat.com/errata/RHSA-2026:73960","https://access.redhat.com/errata/RHSA-2026:73961","https://access.redhat.com/errata/RHSA-2026:73962","https://access.redhat.com/errata/RHSA-2026:74458","https://access.redhat.com/errata/RHSA-2026:74459","https://access.redhat.com/errata/RHSA-2026:74460","https://access.redhat.com/errata/RHSA-2026:74461","https://access.redhat.com/errata/RHSA-2026:74462","https://access.redhat.com/errata/RHSA-2026:74463","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-12912","https://bugzilla.redhat.com/show_bug.cgi?id=2492871","https://gitlab.com/libtiff/libtiff/-/merge_requests/873","https://gitlab.com/libtiff/libtiff/-/work_items/824","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12912","description":"A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."}]},{"artifact":{"id":"85460752c3000dd1","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.39-0exp1ubuntu0.24.04.3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/ubuntu/libxslt1.1@1.1.39-0exp1ubuntu0.24.04.3?arch=amd64&distro=ubuntu-24.04&upstream=libxslt","type":"deb","version":"1.1.39-0exp1ubuntu0.24.04.3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-7425","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxslt","version":"1.1.39-0exp1ubuntu0.24.04.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-7425","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-7425","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7425","date":"2026-10-10","epss":0.00424,"percentile":0.34798}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-7425"},"relatedVulnerabilities":[{"id":"CVE-2025-7425","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-7425","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-7425","date":"2026-10-10","epss":0.00424,"percentile":0.34798}],"urls":["https://access.redhat.com/errata/RHBA-2025:12345","https://access.redhat.com/errata/RHSA-2025:12447","https://access.redhat.com/errata/RHSA-2025:12450","https://access.redhat.com/errata/RHSA-2025:13267","https://access.redhat.com/errata/RHSA-2025:13308","https://access.redhat.com/errata/RHSA-2025:13309","https://access.redhat.com/errata/RHSA-2025:13310","https://access.redhat.com/errata/RHSA-2025:13311","https://access.redhat.com/errata/RHSA-2025:13312","https://access.redhat.com/errata/RHSA-2025:13313","https://access.redhat.com/errata/RHSA-2025:13314","https://access.redhat.com/errata/RHSA-2025:13335","https://access.redhat.com/errata/RHSA-2025:13464","https://access.redhat.com/errata/RHSA-2025:13622","https://access.redhat.com/errata/RHSA-2025:14059","https://access.redhat.com/errata/RHSA-2025:14396","https://access.redhat.com/errata/RHSA-2025:14818","https://access.redhat.com/errata/RHSA-2025:14819","https://access.redhat.com/errata/RHSA-2025:14853","https://access.redhat.com/errata/RHSA-2025:14858","https://access.redhat.com/errata/RHSA-2025:15308","https://access.redhat.com/errata/RHSA-2025:15672","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:21913","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/errata/RHSA-2026:11503","https://access.redhat.com/security/cve/CVE-2025-7425","https://bugzilla.redhat.com/show_bug.cgi?id=2379274","https://gitlab.gnome.org/GNOME/libxslt/-/issues/140","http://seclists.org/fulldisclosure/2025/Aug/0","http://seclists.org/fulldisclosure/2025/Jul/30","http://seclists.org/fulldisclosure/2025/Jul/32","http://seclists.org/fulldisclosure/2025/Jul/35","http://seclists.org/fulldisclosure/2025/Jul/37","http://www.openwall.com/lists/oss-security/2025/07/11/2","https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7425","description":"A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-42528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42528","cwe":"CWE-789","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42528","date":"2026-10-10","epss":0.00416,"percentile":0.33981}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42528"},"relatedVulnerabilities":[{"id":"CVE-2026-42528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42528","cwe":"CWE-789","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42528","date":"2026-10-10","epss":0.00416,"percentile":0.33981}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/12"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42528","description":"A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue"}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-42528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42528","cwe":"CWE-789","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42528","date":"2026-10-10","epss":0.00416,"percentile":0.33981}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42528"},"relatedVulnerabilities":[{"id":"CVE-2026-42528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42528","cwe":"CWE-789","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42528","date":"2026-10-10","epss":0.00416,"percentile":0.33981}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/12"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42528","description":"A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue"}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-42528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42528","cwe":"CWE-789","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42528","date":"2026-10-10","epss":0.00416,"percentile":0.33981}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42528"},"relatedVulnerabilities":[{"id":"CVE-2026-42528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42528","cwe":"CWE-789","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42528","date":"2026-10-10","epss":0.00416,"percentile":0.33981}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/12"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42528","description":"A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue"}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-42528","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42528","cwe":"CWE-789","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42528","date":"2026-10-10","epss":0.00416,"percentile":0.33981}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42528"},"relatedVulnerabilities":[{"id":"CVE-2026-42528","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42528","cwe":"CWE-789","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-42528","date":"2026-10-10","epss":0.00416,"percentile":0.33981}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/12"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42528","description":"A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server child processes.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue"}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-73636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-73636","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73636","date":"2026-10-10","epss":0.00412,"percentile":0.33533}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73636"},"relatedVulnerabilities":[{"id":"CVE-2026-73636","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73636","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73636","date":"2026-10-10","epss":0.00412,"percentile":0.33533}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/27"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73636","description":"Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-73636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-73636","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73636","date":"2026-10-10","epss":0.00412,"percentile":0.33533}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73636"},"relatedVulnerabilities":[{"id":"CVE-2026-73636","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73636","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73636","date":"2026-10-10","epss":0.00412,"percentile":0.33533}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/27"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73636","description":"Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-73636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-73636","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73636","date":"2026-10-10","epss":0.00412,"percentile":0.33533}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73636"},"relatedVulnerabilities":[{"id":"CVE-2026-73636","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73636","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73636","date":"2026-10-10","epss":0.00412,"percentile":0.33533}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/27"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73636","description":"Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-73636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-73636","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73636","date":"2026-10-10","epss":0.00412,"percentile":0.33533}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73636"},"relatedVulnerabilities":[{"id":"CVE-2026-73636","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73636","cwe":"CWE-294","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-73636","date":"2026-10-10","epss":0.00412,"percentile":0.33533}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/27"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73636","description":"Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93990","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-10","epss":0.00403,"percentile":0.32567}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93990"},"relatedVulnerabilities":[{"id":"CVE-2026-93990","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93990","cwe":"CWE-176","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-93990","date":"2026-10-10","epss":0.00403,"percentile":0.32567}],"urls":["https://blog.hartwork.org/posts/expat-2-8-5-released/","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a","https://github.com/libexpat/libexpat/pull/1282","https://github.com/libexpat/libexpat/releases/tag/R_2_8_5","https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93990","description":"Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-10","epss":0.00394,"percentile":0.31513}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-10","epss":0.00394,"percentile":0.31513}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"7c4d4e21ce81068d","cpes":["cpe:2.3:a:apache2:apache2:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2","purl":"pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.list"},{"path":"/var/lib/dpkg/info/apache2.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postinst"},{"path":"/var/lib/dpkg/info/apache2.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.postrm"},{"path":"/var/lib/dpkg/info/apache2.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.preinst"},{"path":"/var/lib/dpkg/info/apache2.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-47360","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47360","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47360","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-47360","date":"2026-10-10","epss":0.00386,"percentile":0.30624}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47360"},"relatedVulnerabilities":[{"id":"CVE-2026-47360","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47360","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-47360","date":"2026-10-10","epss":0.00386,"percentile":0.30624}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/14"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47360","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.\n\n\n\n   \nWhen SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.\n\n\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"5fc351c93c776c98","cpes":["cpe:2.3:a:apache2-bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_bin:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_bin:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-bin","purl":"pkg:deb/ubuntu/apache2-bin@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-bin/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-bin.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-bin.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47360","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47360","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47360","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-47360","date":"2026-10-10","epss":0.00386,"percentile":0.30624}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47360"},"relatedVulnerabilities":[{"id":"CVE-2026-47360","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47360","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-47360","date":"2026-10-10","epss":0.00386,"percentile":0.30624}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/14"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47360","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.\n\n\n\n   \nWhen SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.\n\n\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"23b352f4436f6f79","cpes":["cpe:2.3:a:apache2-data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_data:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_data:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-data","purl":"pkg:deb/ubuntu/apache2-data@2.4.58-1ubuntu8.16?arch=all&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-data.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47360","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47360","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47360","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-47360","date":"2026-10-10","epss":0.00386,"percentile":0.30624}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47360"},"relatedVulnerabilities":[{"id":"CVE-2026-47360","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47360","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-47360","date":"2026-10-10","epss":0.00386,"percentile":0.30624}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/14"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47360","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.\n\n\n\n   \nWhen SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.\n\n\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"d599e3d745c4d9a0","cpes":["cpe:2.3:a:apache2-utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2-utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2_utils:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2-utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*","cpe:2.3:a:apache2:apache2_utils:2.4.58-1ubuntu8.16:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:deb/ubuntu/apache2-utils@2.4.58-1ubuntu8.16?arch=amd64&distro=ubuntu-24.04&upstream=apache2","type":"deb","version":"2.4.58-1ubuntu8.16","language":"","licenses":["Apache-2.0","BSD-2-clause-Darwin","BSD-3-clause-Cambridge","BSD-3-clause-Smrgrav","Cisco","Custom","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","Haines","MD5","PCRE","Zeus"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apache2-utils/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/apache2-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apache2-utils.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/apache2-utils.list"}],"upstreams":[{"name":"apache2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47360","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"apache2","version":"2.4.58-1ubuntu8.16"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47360","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47360","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-47360","date":"2026-10-10","epss":0.00386,"percentile":0.30624}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47360"},"relatedVulnerabilities":[{"id":"CVE-2026-47360","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47360","cwe":"CWE-200","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-47360","date":"2026-10-10","epss":0.00386,"percentile":0.30624}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/10/01/14"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47360","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.\n\n\n\n   \nWhen SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.\n\n\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4775","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4775","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-10","epss":0.00375,"percentile":0.29408}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4775"},"relatedVulnerabilities":[{"id":"CVE-2026-4775","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-4775","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4775","date":"2026-10-10","epss":0.00375,"percentile":0.29408}],"urls":["https://access.redhat.com/errata/RHSA-2026:12265","https://access.redhat.com/errata/RHSA-2026:12271","https://access.redhat.com/errata/RHSA-2026:14929","https://access.redhat.com/errata/RHSA-2026:16055","https://access.redhat.com/errata/RHSA-2026:19150","https://access.redhat.com/errata/RHSA-2026:19363","https://access.redhat.com/errata/RHSA-2026:19585","https://access.redhat.com/errata/RHSA-2026:19586","https://access.redhat.com/errata/RHSA-2026:19604","https://access.redhat.com/errata/RHSA-2026:19608","https://access.redhat.com/errata/RHSA-2026:19609","https://access.redhat.com/errata/RHSA-2026:19657","https://access.redhat.com/errata/RHSA-2026:19659","https://access.redhat.com/errata/RHSA-2026:19702","https://access.redhat.com/errata/RHSA-2026:20583","https://access.redhat.com/errata/RHSA-2026:20585","https://access.redhat.com/errata/RHSA-2026:20591","https://access.redhat.com/errata/RHSA-2026:20592","https://access.redhat.com/errata/RHSA-2026:24992","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:25910","https://access.redhat.com/errata/RHSA-2026:30078","https://access.redhat.com/errata/RHSA-2026:30087","https://access.redhat.com/errata/RHSA-2026:30088","https://access.redhat.com/errata/RHSA-2026:30089","https://access.redhat.com/errata/RHSA-2026:30349","https://access.redhat.com/errata/RHSA-2026:33388","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2026-4775","https://bugzilla.redhat.com/show_bug.cgi?id=2450768","https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4775","description":"A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution."}]},{"artifact":{"id":"c541e1fb62c1e13a","cpes":["cpe:2.3:a:phpseclib\\/phpseclib:phpseclib\\/phpseclib:3.0.55:*:*:*:*:*:*:*"],"name":"phpseclib/phpseclib","purl":"pkg:composer/phpseclib/phpseclib@3.0.55","type":"php-composer","version":"3.0.55","language":"php","licenses":["MIT"],"locations":[{"path":"/var/www/html/3rdparty/composer/installed.json","layerID":"sha256:773195dff589c2bd7a214961ae101169ac0b666f8a5a7d55c6636c355547f741","accessPath":"/var/www/html/3rdparty/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.57"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q97c-8qh3-fpc6","versionConstraint":"<3.0.57 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"phpseclib/phpseclib","version":"3.0.55"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-q97c-8qh3-fpc6","fix":{"state":"fixed","versions":["3.0.57"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"3.0.57"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84308","cwe":"CWE-208","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-84308","cwe":"CWE-385","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84308","date":"2026-10-10","epss":0.00327,"percentile":0.23831}],"risk":0.18475499999999997,"urls":["https://github.com/phpseclib/phpseclib/security/advisories/GHSA-q97c-8qh3-fpc6","https://nvd.nist.gov/vuln/detail/CVE-2026-84308","https://github.com/phpseclib/phpseclib/commit/fb56bc5bb9009b54a6c26b31aeec8ed944f17373","https://github.com/phpseclib/phpseclib/releases/tag/3.0.57","https://github.com/phpseclib/phpseclib/releases/tag/4.0.1"],"severity":"Medium","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q97c-8qh3-fpc6","description":"phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery"},"relatedVulnerabilities":[{"id":"CVE-2026-84308","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84308","cwe":"CWE-208","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-84308","cwe":"CWE-385","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84308","date":"2026-10-10","epss":0.00327,"percentile":0.23831}],"urls":["https://github.com/phpseclib/phpseclib/commit/fb56bc5bb9009b54a6c26b31aeec8ed944f17373","https://github.com/phpseclib/phpseclib/releases/tag/3.0.57","https://github.com/phpseclib/phpseclib/releases/tag/4.0.1","https://github.com/phpseclib/phpseclib/security/advisories/GHSA-q97c-8qh3-fpc6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84308","description":"phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() and subtract(). During the Montgomery ladder in phpseclib/Crypt/EC/BaseCurves/Montgomery.php, the reduction behavior of each step depends on the secret scalar prefix, creating per-step timing and libgmp call-count observations that can reveal a reused 251-bit clamped private scalar. The phpseclib/Crypt/EC/Formats/Keys/MontgomeryPrivate.php derivation path invokes the pure-PHP multiplication without a native-engine check, while phpseclib/Crypt/EC/Formats/Keys/PKCS8.php reaches it when ext-sodium is unavailable. Exploitation requires a reused or long-lived X25519 private key, knowledge of the corresponding public key, execution of the pure-PHP path, and a local observer capable of resolving individual ladder steps or libgmp entry-point calls. Ephemeral X25519 keys, including phpseclib's normal SSH exchange path, are not affected. Recovery of the scalar permanently compromises operations that reuse that key. This issue is fixed in versions 3.0.57 and 4.0.1."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92842","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92842","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92842"},"relatedVulnerabilities":[{"id":"CVE-2026-92842","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92842","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-92842","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-92842","date":"2026-10-10","epss":0.00357,"percentile":0.27413}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-88hq-2827-7pg6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92842","description":"The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output."}]},{"artifact":{"id":"14cfe0f375d6d1af","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg-3.1ubuntu2.2:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.2?arch=amd64&distro=ubuntu-24.04&upstream=zlib","type":"deb","version":"1:1.3.dfsg-3.1ubuntu2.2","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zlib","version":"1:1.3.dfsg-3.1ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-10","epss":0.00356,"percentile":0.27298}],"risk":0.178,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-10","epss":0.00356,"percentile":0.27298}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"a9c1f2bbf70f37c8","cpes":["cpe:2.3:a:libjpeg-turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg-turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg_turbo8:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg-turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*","cpe:2.3:a:libjpeg:libjpeg_turbo8:2.1.5-2ubuntu2:*:*:*:*:*:*:*"],"name":"libjpeg-turbo8","purl":"pkg:deb/ubuntu/libjpeg-turbo8@2.1.5-2ubuntu2?arch=amd64&distro=ubuntu-24.04&upstream=libjpeg-turbo","type":"deb","version":"2.1.5-2ubuntu2","language":"","licenses":["BSD-3-clause","BSD-BY-LC-NE","Expat","NTP","Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libjpeg-turbo8/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libjpeg-turbo8/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libjpeg-turbo8:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libjpeg-turbo"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75466","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libjpeg-turbo","version":"2.1.5-2ubuntu2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75466","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-10-10","epss":0.00355,"percentile":0.27191}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75466"},"relatedVulnerabilities":[{"id":"CVE-2026-75466","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75466","cwe":"CWE-369","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75466","date":"2026-10-10","epss":0.00355,"percentile":0.27191}],"urls":["https://github.com/libjpeg-turbo/libjpeg-turbo/issues/911"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75466","description":"libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-93682","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-93682","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"risk":0.17700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-93682"},"relatedVulnerabilities":[{"id":"CVE-2026-93682","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-93682","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-93682","date":"2026-10-10","epss":0.00354,"percentile":0.27165}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-7875-c8px-7q5f"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93682","description":"When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102633","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102633","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-10","epss":0.00348,"percentile":0.26423}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102633"},"relatedVulnerabilities":[{"id":"CVE-2026-102633","cvss":[{"type":"Primary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102633","cwe":"CWE-190","type":"Primary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-102633","date":"2026-10-10","epss":0.00348,"percentile":0.26423}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003","https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118","https://github.com/libexpat/libexpat/pull/1392","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102633","description":"libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-10","epss":0.00342,"percentile":0.25689}],"risk":0.17099999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-10","epss":0.00342,"percentile":0.25689}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-10","epss":0.00342,"percentile":0.25689}],"risk":0.17099999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-10","epss":0.00342,"percentile":0.25689}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14181","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"risk":0.17049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14181"},"relatedVulnerabilities":[{"id":"CVE-2025-14181","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14181","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14181","date":"2026-10-10","epss":0.00341,"percentile":0.25654}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-cj93-vc83-wgqv"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14181","description":"The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91766","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"risk":0.169,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91766"},"relatedVulnerabilities":[{"id":"CVE-2026-91766","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91766","cwe":"CWE-200","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2026-91766","cwe":"CWE-522","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91766","date":"2026-10-10","epss":0.00338,"percentile":0.25253}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-fpwc-w8rq-cr92"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91766","description":"When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f )."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-17545","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-17545","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"risk":0.161,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-17545"},"relatedVulnerabilities":[{"id":"CVE-2026-17545","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-17545","cwe":"CWE-67","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-17545","date":"2026-10-10","epss":0.00322,"percentile":0.23315}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-9f67-6fw4-hpfp"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-17545","description":"On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-10","epss":0.00294,"percentile":0.20224}],"risk":0.147,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89156"},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-10","epss":0.00294,"percentile":0.20224}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-10","epss":0.00292,"percentile":0.19991}],"risk":0.146,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-10","epss":0.00292,"percentile":0.19991}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-10","epss":0.00292,"percentile":0.19991}],"risk":0.146,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-10","epss":0.00292,"percentile":0.19991}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-10","epss":0.00278,"percentile":0.1863}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-10","epss":0.00278,"percentile":0.1863}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"c63c50e09a049480","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/ubuntu/libsasl2-2@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-10","epss":0.00277,"percentile":0.18522}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-10","epss":0.00277,"percentile":0.18522}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"cd1ded1d948407f7","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.28\\+dfsg1-5ubuntu3.1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/ubuntu/libsasl2-modules-db@2.1.28%2Bdfsg1-5ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.28+dfsg1-5ubuntu3.1","language":"","licenses":["BSD-2-clause","BSD-2.2-clause","BSD-3-Clause-Attribution","BSD-3-clause","BSD-3-clause-JANET","BSD-3-clause-PADL","BSD-4-clause-UC","FSFULLR","GPL-3","GPL-3+","IBM-as-is","MIT-CMU","MIT-Export","MIT-OpenVision","OpenLDAP","RSA-MD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"cyrus-sasl2","version":"2.1.28+dfsg1-5ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-10","epss":0.00277,"percentile":0.18522}],"risk":0.13849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107161"},"relatedVulnerabilities":[{"id":"CVE-2026-107161","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107161","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-107161","date":"2026-10-10","epss":0.00277,"percentile":0.18522}],"urls":["https://access.redhat.com/security/cve/CVE-2026-107161","https://bugzilla.redhat.com/show_bug.cgi?id=2460420","http://www.openwall.com/lists/oss-security/2026/10/09/20"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107161","description":"A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not recompute that size when quoting (escaping special characters) makes the value longer. The under-sized buffer is then passed to strcat(), causing a heap-based out-of-bounds write whose size depends on attacker-controlled input. A malicious or on-path DIGEST-MD5 (or HTTP Digest) server can trigger this flaw in a connecting client by supplying a crafted challenge field, such as realm or nonce, most likely resulting in a crash of the client application."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-10","epss":0.00268,"percentile":0.17389}],"risk":0.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89160"},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-10","epss":0.00268,"percentile":0.17389}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-10","epss":0.00265,"percentile":0.16969}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89092"},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-10","epss":0.00265,"percentile":0.16969}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-10","epss":0.00265,"percentile":0.16969}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89092"},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-10","epss":0.00265,"percentile":0.16969}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"d89ef5f93ba22208","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-10","epss":0.00265,"percentile":0.16952}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-10","epss":0.00265,"percentile":0.16952}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"dbc0224a08459408","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-10","epss":0.00265,"percentile":0.16952}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-10","epss":0.00265,"percentile":0.16952}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"8213e07a58a8ec78","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.7?arch=all&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-10","epss":0.00265,"percentile":0.16952}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-10","epss":0.00265,"percentile":0.16952}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"16e6be2ba255a19b","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.5.3-5ubuntu5.7:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.7?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.7","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-10","epss":0.00265,"percentile":0.16952}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-10","epss":0.00265,"percentile":0.16952}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"cd80a8862611238d","cpes":["cpe:2.3:a:coreutils:coreutils:9.4-3ubuntu6.3:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"9.4-3ubuntu6.3","language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"coreutils","version":"9.4-3ubuntu6.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-10","epss":0.00428,"percentile":0.35138}],"risk":0.1284,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2781"},"relatedVulnerabilities":[{"id":"CVE-2016-2781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-10","epss":0.00428,"percentile":0.35138}],"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."}]},{"artifact":{"id":"271cbc4b0386e5d1","cpes":["cpe:2.3:a:login:login:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","type":"deb","version":"1:4.13+dfsg1-4ubuntu3.2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-10","epss":0.00426,"percentile":0.34981}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-10","epss":0.00426,"percentile":0.34981}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"12ce9c7a4baa2c69","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","type":"deb","version":"1:4.13+dfsg1-4ubuntu3.2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-10","epss":0.00426,"percentile":0.34981}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-10","epss":0.00426,"percentile":0.34981}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"9399a526f720c3e2","cpes":["cpe:2.3:a:libicu74:libicu74:74.2-1ubuntu3.1:*:*:*:*:*:*:*"],"name":"libicu74","purl":"pkg:deb/ubuntu/libicu74@74.2-1ubuntu3.1?arch=amd64&distro=ubuntu-24.04&upstream=icu","type":"deb","version":"74.2-1ubuntu3.1","language":"","licenses":["GPL-3","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu74/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libicu74/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu74:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libicu74:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5222","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"icu","version":"74.2-1ubuntu3.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-5222","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5222","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5222","date":"2026-10-10","epss":0.00425,"percentile":0.3485}],"risk":0.1275,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5222"},"relatedVulnerabilities":[{"id":"CVE-2025-5222","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5222","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-5222","date":"2026-10-10","epss":0.00425,"percentile":0.3485}],"urls":["https://access.redhat.com/errata/RHSA-2025:11888","https://access.redhat.com/errata/RHSA-2025:12083","https://access.redhat.com/errata/RHSA-2025:12331","https://access.redhat.com/errata/RHSA-2025:12332","https://access.redhat.com/errata/RHSA-2025:12333","https://access.redhat.com/errata/RHSA-2026:54544","https://access.redhat.com/errata/RHSA-2026:54553","https://access.redhat.com/errata/RHSA-2026:54581","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/security/cve/CVE-2025-5222","https://bugzilla.redhat.com/show_bug.cgi?id=2368600","https://unicode-org.atlassian.net/jira/software/c/projects/ICU/issues/ICU-22957","https://lists.debian.org/debian-lts-announce/2025/06/msg00015.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5222","description":"A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-10","epss":0.00247,"percentile":0.14681}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89158"},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-10","epss":0.00247,"percentile":0.14681}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-20013","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-10-10","epss":0.02234,"percentile":0.8229}],"risk":0.1117,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-20013"},"relatedVulnerabilities":[{"id":"CVE-2016-20013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-10-10","epss":0.02234,"percentile":0.8229}],"urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-20013","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-10-10","epss":0.02234,"percentile":0.8229}],"risk":0.1117,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-20013"},"relatedVulnerabilities":[{"id":"CVE-2016-20013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-10-10","epss":0.02234,"percentile":0.8229}],"urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password."}]},{"artifact":{"id":"3f97bf43ff1778dc","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.6","type":"deb","version":"1:2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"cb5c6761273d29c4","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"c02905cff08d2f0f","cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"e0380baf79d39c85","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"ee5b3d781052e1ec","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"1bddfbdf64661f04","cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"f1e4c52ae1a4fa42","cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-10","epss":0.00216,"percentile":0.11041}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-10","epss":0.00214,"percentile":0.10858}],"risk":0.107,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103111"},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-10","epss":0.00214,"percentile":0.10858}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"ee06eab4d33d40b1","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.6.1-2ubuntu0.6:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.6.1-2ubuntu0.6?arch=amd64&distro=ubuntu-24.04&upstream=expat","type":"deb","version":"2.6.1-2ubuntu0.6","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-66382","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"expat","version":"2.6.1-2ubuntu0.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-66382","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-10-10","epss":0.00203,"percentile":0.09413}],"risk":0.1015,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-66382"},"relatedVulnerabilities":[{"id":"CVE-2025-66382","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-66382","cwe":"CWE-407","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-66382","date":"2026-10-10","epss":0.00203,"percentile":0.09413}],"urls":["https://github.com/libexpat/libexpat/issues/1076","http://www.openwall.com/lists/oss-security/2025/12/02/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-66382","description":"In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time."}]},{"artifact":{"id":"0afbfa6e4f88ae06","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/ubuntu/libx11-6@2%3A1.8.7-1build1?arch=amd64&distro=ubuntu-24.04&upstream=libx11","type":"deb","version":"2:1.8.7-1build1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libx11","version":"2:1.8.7-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-10","epss":0.00199,"percentile":0.08948}],"risk":0.0995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88806"},"relatedVulnerabilities":[{"id":"CVE-2026-88806","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-10","epss":0.00199,"percentile":0.08948}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88806","description":"A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map."}]},{"artifact":{"id":"f0222bcd7168265e","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/ubuntu/libx11-data@2%3A1.8.7-1build1?arch=all&distro=ubuntu-24.04&upstream=libx11","type":"deb","version":"2:1.8.7-1build1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-88806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libx11","version":"2:1.8.7-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88806","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-10","epss":0.00199,"percentile":0.08948}],"risk":0.0995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88806"},"relatedVulnerabilities":[{"id":"CVE-2026-88806","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88806","cwe":"CWE-122","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-88806","date":"2026-10-10","epss":0.00199,"percentile":0.08948}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88806","description":"A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map."}]},{"artifact":{"id":"0afbfa6e4f88ae06","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/ubuntu/libx11-6@2%3A1.8.7-1build1?arch=amd64&distro=ubuntu-24.04&upstream=libx11","type":"deb","version":"2:1.8.7-1build1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94283","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libx11","version":"2:1.8.7-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-94283","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-10","epss":0.00199,"percentile":0.08926}],"risk":0.0995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-94283"},"relatedVulnerabilities":[{"id":"CVE-2026-94283","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-10","epss":0.00199,"percentile":0.08926}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94283","description":"An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"f0222bcd7168265e","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/ubuntu/libx11-data@2%3A1.8.7-1build1?arch=all&distro=ubuntu-24.04&upstream=libx11","type":"deb","version":"2:1.8.7-1build1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94283","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libx11","version":"2:1.8.7-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-94283","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-10","epss":0.00199,"percentile":0.08926}],"risk":0.0995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-94283"},"relatedVulnerabilities":[{"id":"CVE-2026-94283","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94283","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94283","date":"2026-10-10","epss":0.00199,"percentile":0.08926}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=42d0303f243002a9856c76060569a61893c670dd"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94283","description":"An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"3f97bf43ff1778dc","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.6","type":"deb","version":"1:2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"cb5c6761273d29c4","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"c02905cff08d2f0f","cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"e0380baf79d39c85","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"ee5b3d781052e1ec","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"1bddfbdf64661f04","cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"f1e4c52ae1a4fa42","cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-10","epss":0.00186,"percentile":0.0758}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1218","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1218","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"risk":0.091,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1218"},"relatedVulnerabilities":[{"id":"CVE-2025-1218","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1218","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1218","date":"2026-10-10","epss":0.00182,"percentile":0.07169}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-r6x9-5r99-36j7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1218","description":"The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process."}]},{"artifact":{"id":"db9250ad2fb3f819","cpes":["cpe:2.3:a:gpgv:gpgv:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-10-10","epss":0.00293,"percentile":0.20114}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-10-10","epss":0.00293,"percentile":0.20114}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"85460752c3000dd1","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.39-0exp1ubuntu0.24.04.3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/ubuntu/libxslt1.1@1.1.39-0exp1ubuntu0.24.04.3?arch=amd64&distro=ubuntu-24.04&upstream=libxslt","type":"deb","version":"1.1.39-0exp1ubuntu0.24.04.3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10911","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxslt","version":"1.1.39-0exp1ubuntu0.24.04.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10911","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10911","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-10911","date":"2026-10-10","epss":0.00173,"percentile":0.06106}],"risk":0.0865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10911"},"relatedVulnerabilities":[{"id":"CVE-2025-10911","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10911","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-10911","date":"2026-10-10","epss":0.00173,"percentile":0.06106}],"urls":["https://access.redhat.com/errata/RHSA-2026:11015","https://access.redhat.com/errata/RHSA-2026:26355","https://access.redhat.com/errata/RHSA-2026:28243","https://access.redhat.com/errata/RHSA-2026:28584","https://access.redhat.com/errata/RHSA-2026:29807","https://access.redhat.com/errata/RHSA-2026:29809","https://access.redhat.com/errata/RHSA-2026:29811","https://access.redhat.com/errata/RHSA-2026:29814","https://access.redhat.com/errata/RHSA-2026:29975","https://access.redhat.com/errata/RHSA-2026:29976","https://access.redhat.com/errata/RHSA-2026:30847","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2025-10911","https://bugzilla.redhat.com/show_bug.cgi?id=2397838","https://gitlab.gnome.org/GNOME/libxslt/-/issues/144","https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10911","description":"A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash."}]},{"artifact":{"id":"85460752c3000dd1","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.39-0exp1ubuntu0.24.04.3:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/ubuntu/libxslt1.1@1.1.39-0exp1ubuntu0.24.04.3?arch=amd64&distro=ubuntu-24.04&upstream=libxslt","type":"deb","version":"1.1.39-0exp1ubuntu0.24.04.3","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11731","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxslt","version":"1.1.39-0exp1ubuntu0.24.04.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-11731","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-11731","cwe":"CWE-843","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-11731","date":"2026-10-10","epss":0.00283,"percentile":0.19156}],"risk":0.0849,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-11731"},"relatedVulnerabilities":[{"id":"CVE-2025-11731","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11731","cwe":"CWE-843","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-11731","date":"2026-10-10","epss":0.00283,"percentile":0.19156}],"urls":["https://access.redhat.com/errata/RHSA-2026:11015","https://access.redhat.com/security/cve/CVE-2025-11731","https://bugzilla.redhat.com/show_bug.cgi?id=2403688","https://gitlab.gnome.org/GNOME/libxslt/-/issues/151","https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11731","description":"A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6103","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6103","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"risk":0.0835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6103"},"relatedVulnerabilities":[{"id":"CVE-2026-6103","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6103","cwe":"CWE-190","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-6103","date":"2026-10-10","epss":0.00167,"percentile":0.05452}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-j3wh-g957-2m85"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6103","description":"phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89162","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89162","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89162","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89162","date":"2026-10-10","epss":0.00156,"percentile":0.04187}],"risk":0.078,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89162"},"relatedVulnerabilities":[{"id":"CVE-2026-89162","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89162","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89162","date":"2026-10-10","epss":0.00156,"percentile":0.04187}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q7rw-r7qq-2hx6"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89162","description":"In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe."}]},{"artifact":{"id":"3f97bf43ff1778dc","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.6","type":"deb","version":"1:2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"risk":0.078,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"cb5c6761273d29c4","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"risk":0.078,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"c02905cff08d2f0f","cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"risk":0.078,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"e0380baf79d39c85","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"risk":0.078,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"ee5b3d781052e1ec","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"risk":0.078,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"1bddfbdf64661f04","cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"risk":0.078,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"f1e4c52ae1a4fa42","cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78410","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"risk":0.078,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78410"},"relatedVulnerabilities":[{"id":"CVE-2026-78410","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78410","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78410","date":"2026-10-10","epss":0.00156,"percentile":0.04184}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78410","https://bugzilla.redhat.com/show_bug.cgi?id=2522684","https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78410","description":"A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91767","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91767"},"relatedVulnerabilities":[{"id":"CVE-2026-91767","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91767","cwe":"CWE-122","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91767","date":"2026-10-10","epss":0.00154,"percentile":0.04033}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-xr7j-rvgx-xq5p"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91767","description":"php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default."}]},{"artifact":{"id":"3f97bf43ff1778dc","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.6","type":"deb","version":"1:2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.6"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"cb5c6761273d29c4","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"c02905cff08d2f0f","cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"e0380baf79d39c85","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"ee5b3d781052e1ec","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"1bddfbdf64661f04","cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"f1e4c52ae1a4fa42","cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.6:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.6?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.39.3-9ubuntu6.6","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"risk":0.077,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78409"},"relatedVulnerabilities":[{"id":"CVE-2026-78409","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78409","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78409","date":"2026-10-10","epss":0.00154,"percentile":0.04002}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78409","https://bugzilla.redhat.com/show_bug.cgi?id=2522607","https://github.com/util-linux/util-linux/security/advisories/GHSA-8f2p-47x3-43mv"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78409","description":"The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint."}]},{"artifact":{"id":"bb3fa210c4617fe7","cpes":["cpe:2.3:a:libacl1:libacl1:2.3.2-1build1.1:*:*:*:*:*:*:*"],"name":"libacl1","purl":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64&distro=ubuntu-24.04&upstream=acl","type":"deb","version":"2.3.2-1build1.1","language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"acl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54369","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"acl","version":"2.3.2-1build1.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-54369","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54369","date":"2026-10-10","epss":0.00153,"percentile":0.03926}],"risk":0.0765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54369"},"relatedVulnerabilities":[{"id":"CVE-2026-54369","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54369","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54369","date":"2026-10-10","epss":0.00153,"percentile":0.03926}],"urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions","https://access.redhat.com/errata/RHSA-2026:34351","https://access.redhat.com/errata/RHSA-2026:42736","https://access.redhat.com/errata/RHSA-2026:42739","https://access.redhat.com/errata/RHSA-2026:43420","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:46836","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:54769","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:64805","https://access.redhat.com/errata/RHSA-2026:67140","https://access.redhat.com/errata/RHSA-2026:67142","https://access.redhat.com/errata/RHSA-2026:67144","https://access.redhat.com/security/cve/CVE-2026-54369","https://bugzilla.redhat.com/show_bug.cgi?id=2490277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54369","description":"acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation."}]},{"artifact":{"id":"b65ce48fce2635c7","cpes":["cpe:2.3:a:dash:dash:0.5.12-6ubuntu5:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.5.12-6ubuntu5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102474","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"dash","version":"0.5.12-6ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102474","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-10-10","epss":0.00144,"percentile":0.03215}],"risk":0.07200000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102474"},"relatedVulnerabilities":[{"id":"CVE-2026-102474","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102474","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102474","date":"2026-10-10","epss":0.00144,"percentile":0.03215}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102474","https://bugzilla.redhat.com/show_bug.cgi?id=2543004"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102474","description":"A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \\u or \\U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-10","epss":0.00144,"percentile":0.03208}],"risk":0.07200000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18374"},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-10","epss":0.00144,"percentile":0.03208}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18374","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18374","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-10","epss":0.00144,"percentile":0.03208}],"risk":0.07200000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18374"},"relatedVulnerabilities":[{"id":"CVE-2026-18374","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.9,"impactScore":3.4,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-18374","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18374","date":"2026-10-10","epss":0.00144,"percentile":0.03208}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34574","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015","http://www.openwall.com/lists/oss-security/2026/08/27/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18374","description":"Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.\n\n\n\nThis usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."}]},{"artifact":{"id":"b640c480c74193fe","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-3ubuntu0.4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.35+dfsg-3ubuntu0.4","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18508","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tar","version":"1.35+dfsg-3ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18508","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-10-10","epss":0.00141,"percentile":0.02975}],"risk":0.07050000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18508"},"relatedVulnerabilities":[{"id":"CVE-2026-18508","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18508","cwe":"CWE-59","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18508","date":"2026-10-10","epss":0.00141,"percentile":0.02975}],"urls":["https://access.redhat.com/errata/RHSA-2026:50807","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18508","https://bugzilla.redhat.com/show_bug.cgi?id=2509843"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18508","description":"A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."}]},{"artifact":{"id":"70af7578e719f236","cpes":["cpe:2.3:a:libapache2-mod-php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod-php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod_php8.3:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2-mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2_mod:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2-mod-php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:libapache2:libapache2_mod_php8.3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"libapache2-mod-php8.3","purl":"pkg:deb/ubuntu/libapache2-mod-php8.3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libapache2-mod-php8.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.list"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postinst"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.postrm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.prerm"},{"path":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libapache2-mod-php8.3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"01b466b34eb577fe","cpes":["cpe:2.3:a:php8.3-bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_bcmath:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_bcmath:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-bcmath","purl":"pkg:deb/ubuntu/php8.3-bcmath@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-bcmath/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-bcmath.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.list"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.postrm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.preinst"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.prerm"},{"path":"/var/lib/dpkg/info/php8.3-bcmath.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-bcmath.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"858f45e4d95de23e","cpes":["cpe:2.3:a:php8.3-cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_cli:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_cli:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-cli","purl":"pkg:deb/ubuntu/php8.3-cli@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-cli/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-cli.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.list"},{"path":"/var/lib/dpkg/info/php8.3-cli.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postinst"},{"path":"/var/lib/dpkg/info/php8.3-cli.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.postrm"},{"path":"/var/lib/dpkg/info/php8.3-cli.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.prerm"},{"path":"/var/lib/dpkg/info/php8.3-cli.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-cli.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"9f2f0697789db8b3","cpes":["cpe:2.3:a:php8.3-common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_common:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_common:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-common","purl":"pkg:deb/ubuntu/php8.3-common@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-common.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.list"},{"path":"/var/lib/dpkg/info/php8.3-common.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postinst"},{"path":"/var/lib/dpkg/info/php8.3-common.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.postrm"},{"path":"/var/lib/dpkg/info/php8.3-common.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.preinst"},{"path":"/var/lib/dpkg/info/php8.3-common.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.prerm"},{"path":"/var/lib/dpkg/info/php8.3-common.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-common.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"a3b8dbe4370e74bf","cpes":["cpe:2.3:a:php8.3-curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_curl:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_curl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-curl","purl":"pkg:deb/ubuntu/php8.3-curl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-curl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.list"},{"path":"/var/lib/dpkg/info/php8.3-curl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-curl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-curl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-curl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-curl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"a084794bf88be208","cpes":["cpe:2.3:a:php8.3-gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gd:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gd:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gd","purl":"pkg:deb/ubuntu/php8.3-gd@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gd.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.list"},{"path":"/var/lib/dpkg/info/php8.3-gd.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gd.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gd.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gd.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gd.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"60dfc35e422c33bf","cpes":["cpe:2.3:a:php8.3-gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_gmp:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_gmp:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-gmp","purl":"pkg:deb/ubuntu/php8.3-gmp@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-gmp/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-gmp.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.list"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.postrm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.preinst"},{"path":"/var/lib/dpkg/info/php8.3-gmp.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.prerm"},{"path":"/var/lib/dpkg/info/php8.3-gmp.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-gmp.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"1943406bb20e5495","cpes":["cpe:2.3:a:php8.3-intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_intl:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_intl:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-intl","purl":"pkg:deb/ubuntu/php8.3-intl@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-intl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-intl.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.list"},{"path":"/var/lib/dpkg/info/php8.3-intl.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.postrm"},{"path":"/var/lib/dpkg/info/php8.3-intl.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.preinst"},{"path":"/var/lib/dpkg/info/php8.3-intl.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.prerm"},{"path":"/var/lib/dpkg/info/php8.3-intl.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-intl.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"9166d4e795c146bc","cpes":["cpe:2.3:a:php8.3-mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_mbstring:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_mbstring:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-mbstring","purl":"pkg:deb/ubuntu/php8.3-mbstring@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-mbstring/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-mbstring.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.list"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.postrm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.preinst"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.prerm"},{"path":"/var/lib/dpkg/info/php8.3-mbstring.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-mbstring.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"fd372ea5b9c0c03b","cpes":["cpe:2.3:a:php8.3-opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_opcache:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_opcache:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-opcache","purl":"pkg:deb/ubuntu/php8.3-opcache@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-opcache/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-opcache.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.list"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.postrm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.preinst"},{"path":"/var/lib/dpkg/info/php8.3-opcache.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.prerm"},{"path":"/var/lib/dpkg/info/php8.3-opcache.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-opcache.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"82f7c85a8024d902","cpes":["cpe:2.3:a:php8.3-readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_readline:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_readline:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-readline","purl":"pkg:deb/ubuntu/php8.3-readline@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-readline/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-readline.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.list"},{"path":"/var/lib/dpkg/info/php8.3-readline.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.postrm"},{"path":"/var/lib/dpkg/info/php8.3-readline.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.preinst"},{"path":"/var/lib/dpkg/info/php8.3-readline.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.prerm"},{"path":"/var/lib/dpkg/info/php8.3-readline.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-readline.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"cfcaef2a62470603","cpes":["cpe:2.3:a:php8.3-sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_sqlite3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_sqlite3:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-sqlite3","purl":"pkg:deb/ubuntu/php8.3-sqlite3@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-sqlite3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.list"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.postrm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.preinst"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.prerm"},{"path":"/var/lib/dpkg/info/php8.3-sqlite3.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-sqlite3.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"33e2846dc61882a3","cpes":["cpe:2.3:a:php8.3-xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_xml:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_xml:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-xml","purl":"pkg:deb/ubuntu/php8.3-xml@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-xml/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-xml.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.list"},{"path":"/var/lib/dpkg/info/php8.3-xml.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.postrm"},{"path":"/var/lib/dpkg/info/php8.3-xml.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.preinst"},{"path":"/var/lib/dpkg/info/php8.3-xml.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.prerm"},{"path":"/var/lib/dpkg/info/php8.3-xml.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-xml.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"0337e9bfea0ca590","cpes":["cpe:2.3:a:php8.3-zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3-zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3_zip:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3-zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*","cpe:2.3:a:php8.3:php8.3_zip:8.3.6-0ubuntu0.24.04.11:*:*:*:*:*:*:*"],"name":"php8.3-zip","purl":"pkg:deb/ubuntu/php8.3-zip@8.3.6-0ubuntu0.24.04.11?arch=amd64&distro=ubuntu-24.04&upstream=php8.3","type":"deb","version":"8.3.6-0ubuntu0.24.04.11","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-2-clause-libmagic","BSD-3-clause","BSD-4-clause","BSD-TSRM","CC0","Expat","GD","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-3+","OpenLDAP","PHP-3.0","PHP-3.01","Zend-Engine-2.00","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/php8.3-common/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/php8.3-zip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/php8.3-zip.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.list"},{"path":"/var/lib/dpkg/info/php8.3-zip.postinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.postrm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.postrm"},{"path":"/var/lib/dpkg/info/php8.3-zip.preinst","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.preinst"},{"path":"/var/lib/dpkg/info/php8.3-zip.prerm","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.prerm"},{"path":"/var/lib/dpkg/info/php8.3-zip.triggers","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/php8.3-zip.triggers"}],"upstreams":[{"name":"php8.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-91769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"php8.3","version":"8.3.6-0ubuntu0.24.04.11"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-91769","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"risk":0.0675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-91769"},"relatedVulnerabilities":[{"id":"CVE-2026-91769","cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-91769","cwe":"CWE-297","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2026-91769","date":"2026-10-10","epss":0.00135,"percentile":0.02586}],"urls":["https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-91769","description":"PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another."}]},{"artifact":{"id":"b65ce48fce2635c7","cpes":["cpe:2.3:a:dash:dash:0.5.12-6ubuntu5:*:*:*:*:*:*:*"],"name":"dash","purl":"pkg:deb/ubuntu/dash@0.5.12-6ubuntu5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"0.5.12-6ubuntu5","language":"","licenses":["BSD-3-Clause","BSD-3-clause","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/dash/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/dash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/dash.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.list"},{"path":"/var/lib/dpkg/info/dash.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.postinst"},{"path":"/var/lib/dpkg/info/dash.postrm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.postrm"},{"path":"/var/lib/dpkg/info/dash.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/dash.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-102473","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"dash","version":"0.5.12-6ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-102473","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-10-10","epss":0.0013,"percentile":0.02312}],"risk":0.065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102473"},"relatedVulnerabilities":[{"id":"CVE-2026-102473","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102473","cwe":"CWE-1333","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102473","date":"2026-10-10","epss":0.0013,"percentile":0.02312}],"urls":["https://access.redhat.com/security/cve/CVE-2026-102473","https://bugzilla.redhat.com/show_bug.cgi?id=2543005"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102473","description":"A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-10","epss":0.00129,"percentile":0.02221}],"risk":0.0645,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-10","epss":0.00129,"percentile":0.02221}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-10","epss":0.00129,"percentile":0.02221}],"risk":0.0645,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-10","epss":0.00129,"percentile":0.02221}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89161","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89161","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-10","epss":0.00126,"percentile":0.02044}],"risk":0.063,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89161"},"relatedVulnerabilities":[{"id":"CVE-2026-89161","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-10","epss":0.00126,"percentile":0.02044}],"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."}]},{"artifact":{"id":"f0ae564f6cc76e8b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-10","epss":0.00124,"percentile":0.01915}],"risk":0.062,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86805"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-10","epss":0.00124,"percentile":0.01915}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"a2811c097c883c6c","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.9?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.9","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.9"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-10","epss":0.00124,"percentile":0.01915}],"risk":0.062,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86805"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-10","epss":0.00124,"percentile":0.01915}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18495","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18495","date":"2026-10-10","epss":0.00117,"percentile":0.01544}],"risk":0.0585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18495"},"relatedVulnerabilities":[{"id":"CVE-2026-18495","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.8,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18495","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18495","date":"2026-10-10","epss":0.00117,"percentile":0.01544}],"urls":["https://access.redhat.com/errata/RHSA-2026:53467","https://access.redhat.com/security/cve/CVE-2026-18495","https://bugzilla.redhat.com/show_bug.cgi?id=2531414","https://gitlab.com/libtiff/libtiff/-/merge_requests/729","https://gitlab.com/libtiff/libtiff/-/tree/67fd283d276f09db54dc39b9ef7b979d4b45c4b1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18495","description":"A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption."}]},{"artifact":{"id":"0afbfa6e4f88ae06","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/ubuntu/libx11-6@2%3A1.8.7-1build1?arch=amd64&distro=ubuntu-24.04&upstream=libx11","type":"deb","version":"2:1.8.7-1build1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94285","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libx11","version":"2:1.8.7-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-94285","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-94285","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94285","date":"2026-10-10","epss":0.00111,"percentile":0.01279}],"risk":0.05550000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-94285"},"relatedVulnerabilities":[{"id":"CVE-2026-94285","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94285","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94285","date":"2026-10-10","epss":0.00111,"percentile":0.01279}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=980868483446f24f9658d26aa5bfa42f3da6dd3a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94285","description":"An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"f0222bcd7168265e","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/ubuntu/libx11-data@2%3A1.8.7-1build1?arch=all&distro=ubuntu-24.04&upstream=libx11","type":"deb","version":"2:1.8.7-1build1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94285","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libx11","version":"2:1.8.7-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-94285","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-94285","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94285","date":"2026-10-10","epss":0.00111,"percentile":0.01279}],"risk":0.05550000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-94285"},"relatedVulnerabilities":[{"id":"CVE-2026-94285","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.1,"impactScore":2.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94285","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94285","date":"2026-10-10","epss":0.00111,"percentile":0.01279}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=980868483446f24f9658d26aa5bfa42f3da6dd3a"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94285","description":"An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"0afbfa6e4f88ae06","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.8.7-1build1:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/ubuntu/libx11-6@2%3A1.8.7-1build1?arch=amd64&distro=ubuntu-24.04&upstream=libx11","type":"deb","version":"2:1.8.7-1build1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libx11","version":"2:1.8.7-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-94284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-94284","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94284","date":"2026-10-10","epss":0.00103,"percentile":0.00935}],"risk":0.051500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-94284"},"relatedVulnerabilities":[{"id":"CVE-2026-94284","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94284","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94284","date":"2026-10-10","epss":0.00103,"percentile":0.00935}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=1b7904002d212eed40949ccf4e8e7156f9fec0e2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94284","description":"An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"f0222bcd7168265e","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.8.7-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.8.7-1build1:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/ubuntu/libx11-data@2%3A1.8.7-1build1?arch=all&distro=ubuntu-24.04&upstream=libx11","type":"deb","version":"2:1.8.7-1build1","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94284","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libx11","version":"2:1.8.7-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-94284","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-94284","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94284","date":"2026-10-10","epss":0.00103,"percentile":0.00935}],"risk":0.051500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-94284"},"relatedVulnerabilities":[{"id":"CVE-2026-94284","cvss":[{"type":"Secondary","source":"meissner@suse.de","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94284","cwe":"CWE-125","type":"Secondary","source":"meissner@suse.de"}],"epss":[{"cve":"CVE-2026-94284","date":"2026-10-10","epss":0.00103,"percentile":0.00935}],"urls":["https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/310/diffs?commit_id=1b7904002d212eed40949ccf4e8e7156f9fec0e2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94284","description":"An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients."}]},{"artifact":{"id":"bb3fa210c4617fe7","cpes":["cpe:2.3:a:libacl1:libacl1:2.3.2-1build1.1:*:*:*:*:*:*:*"],"name":"libacl1","purl":"pkg:deb/ubuntu/libacl1@2.3.2-1build1.1?arch=amd64&distro=ubuntu-24.04&upstream=acl","type":"deb","version":"2.3.2-1build1.1","language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libacl1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libacl1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libacl1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libacl1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"acl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"acl","version":"2.3.2-1build1.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-54370","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-54370","date":"2026-10-10","epss":0.00088,"percentile":0.00375}],"risk":0.044000000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54370"},"relatedVulnerabilities":[{"id":"CVE-2026-54370","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54370","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-54370","date":"2026-10-10","epss":0.00088,"percentile":0.00375}],"urls":["https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5","https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1","https://www.vulncheck.com/advisories/acl-toctou-symlink-traversal-via-getfacl-setfacl-chacl"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54370","description":"acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation."}]},{"artifact":{"id":"17317631a09f6a3f","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:255.4-1ubuntu8.17:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@255.4-1ubuntu8.17?arch=amd64&distro=ubuntu-24.04&upstream=systemd","type":"deb","version":"255.4-1ubuntu8.17","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"systemd","version":"255.4-1ubuntu8.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-40228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-10-10","epss":0.00139,"percentile":0.02856}],"risk":0.0417,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-40228"},"relatedVulnerabilities":[{"id":"CVE-2026-40228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-10-10","epss":0.00139,"percentile":0.02856}],"urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."}]},{"artifact":{"id":"c37cad8d5a3a6548","cpes":["cpe:2.3:a:libudev1:libudev1:255.4-1ubuntu8.17:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@255.4-1ubuntu8.17?arch=amd64&distro=ubuntu-24.04&upstream=systemd","type":"deb","version":"255.4-1ubuntu8.17","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-40228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"systemd","version":"255.4-1ubuntu8.17"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-40228","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-10-10","epss":0.00139,"percentile":0.02856}],"risk":0.0417,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-40228"},"relatedVulnerabilities":[{"id":"CVE-2026-40228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40228","cwe":"CWE-669","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40228","date":"2026-10-10","epss":0.00139,"percentile":0.02856}],"urls":["https://www.openwall.com/lists/oss-security/2026/04/08/1","http://www.openwall.com/lists/oss-security/2026/05/05/1"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40228","description":"In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."}]},{"artifact":{"id":"b640c480c74193fe","cpes":["cpe:2.3:a:tar:tar:1.35\\+dfsg-3ubuntu0.4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.35%2Bdfsg-3ubuntu0.4?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.35+dfsg-3ubuntu0.4","language":"","licenses":["GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-18477","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tar","version":"1.35+dfsg-3ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-18477","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-10-10","epss":0.0008,"percentile":0.00149}],"risk":0.04,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-18477"},"relatedVulnerabilities":[{"id":"CVE-2026-18477","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18477","cwe":"CWE-367","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-18477","date":"2026-10-10","epss":0.0008,"percentile":0.00149}],"urls":["https://access.redhat.com/errata/RHSA-2026:49361","https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-18477","https://bugzilla.redhat.com/show_bug.cgi?id=2509735"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18477","description":"A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."}]},{"artifact":{"id":"db9250ad2fb3f819","cpes":["cpe:2.3:a:gpgv:gpgv:2.4.4-2ubuntu17.6:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.6?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.6","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:d81fb2a7c6ee3be05fdefaa7fd223be219c1ab172083ec1b994c3ecda33ac0a8","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-105712","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-10-10","epss":0.00123,"percentile":0.01879}],"risk":0.036899999999999995,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-105712"},"relatedVulnerabilities":[{"id":"CVE-2026-105712","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105712","cwe":"CWE-61","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-105712","date":"2026-10-10","epss":0.00123,"percentile":0.01879}],"urls":["https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88","https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html","https://static.dev.gnupg.org/T8159.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105712","description":"gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."}]},{"artifact":{"id":"14ba939d2194f6f5","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.14\\+dfsg-1.3ubuntu3.10:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.14%2Bdfsg-1.3ubuntu3.10?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.9.14+dfsg-1.3ubuntu3.10","language":"","licenses":["ISC","MIT-1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-11979","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libxml2","version":"2.9.14+dfsg-1.3ubuntu3.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-11979","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-11979","cwe":"CWE-121","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-11979","date":"2026-10-10","epss":0.00148,"percentile":0.03555}],"risk":0.007400000000000001,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-11979"},"relatedVulnerabilities":[{"id":"CVE-2026-11979","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11979","cwe":"CWE-121","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-11979","date":"2026-10-10","epss":0.00148,"percentile":0.03555}],"urls":["https://cert.pl/en/posts/2026/06/CVE-2026-11979","https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11979","description":"libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.\nBy supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame.\nSuccessful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process.\n\nThis issue has been fixed in the commit c2e233fc.\n\nNOTE:\nThe maintainers of this project did not agree that this issue is a vulnerability and considered it a bug."}]},{"artifact":{"id":"4d58ccf62566d9b4","cpes":["cpe:2.3:a:libgd3:libgd3:2.3.3-9ubuntu5:*:*:*:*:*:*:*"],"name":"libgd3","purl":"pkg:deb/ubuntu/libgd3@2.3.3-9ubuntu5?arch=amd64&distro=ubuntu-24.04&upstream=libgd2","type":"deb","version":"2.3.3-9ubuntu5","language":"","licenses":["sha256:53c9aa3ebfa5ab3aa28a5467aca74c10446b2e7ed21d68bdc8cc372f32d551ee"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgd3/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libgd3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgd3:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libgd3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libgd2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9672","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libgd2","version":"2.3.3-9ubuntu5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-9672","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9672"},"relatedVulnerabilities":[{"id":"CVE-2026-9672","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"ae36307ca07e59fc","cpes":["cpe:2.3:a:libtiff6:libtiff6:4.5.1\\+git230720-4ubuntu2.5:*:*:*:*:*:*:*"],"name":"libtiff6","purl":"pkg:deb/ubuntu/libtiff6@4.5.1%2Bgit230720-4ubuntu2.5?arch=amd64&distro=ubuntu-24.04&upstream=tiff","type":"deb","version":"4.5.1+git230720-4ubuntu2.5","language":"","licenses":["Hylafax"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtiff6/copyright","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/usr/share/doc/libtiff6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","layerID":"sha256:f7222612d49d0046b3f571e057e1016ce1ebb555b6502f2b19d61a5f9b9f094a","accessPath":"/var/lib/dpkg/info/libtiff6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"tiff"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-36849","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"tiff","version":"4.5.1+git230720-4ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-36849","fix":{"state":"not-fixed","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-36849"},"relatedVulnerabilities":[{"id":"CVE-2026-36849","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"50fc11fddcc90dd0","cpes":["cpe:2.3:a:web-auth\\/webauthn-lib:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn-lib:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn_lib:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn_lib:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web-auth\\/webauthn:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web_auth\\/webauthn:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web:web-auth\\/webauthn-lib:4.9.3:*:*:*:*:*:*:*","cpe:2.3:a:web:web_auth\\/webauthn_lib:4.9.3:*:*:*:*:*:*:*"],"name":"web-auth/webauthn-lib","purl":"pkg:composer/web-auth/webauthn-lib@4.9.3","type":"php-composer","version":"4.9.3","language":"php","licenses":["MIT"],"locations":[{"path":"/var/www/html/3rdparty/composer/installed.json","layerID":"sha256:773195dff589c2bd7a214961ae101169ac0b666f8a5a7d55c6636c355547f741","accessPath":"/var/www/html/3rdparty/composer/installed.json","annotations":{"evidence":"primary"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.3.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gq4g-fpc9-vjfq","versionConstraint":">=4.9.0,<5.3.5 (semantic)"},"matcher":"stock-matcher","searchedBy":{"package":{"name":"web-auth/webauthn-lib","version":"4.9.3"},"language":"php","namespace":"github:language:php"}}],"vulnerability":{"id":"GHSA-gq4g-fpc9-vjfq","fix":{"state":"fixed","versions":["5.3.5"],"available":[{"date":"2026-07-08","kind":"first-observed","version":"5.3.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":2.9},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/web-auth/webauthn-framework/security/advisories/GHSA-gq4g-fpc9-vjfq"],"severity":"Low","namespace":"github:language:php","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gq4g-fpc9-vjfq","description":"Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection"},"relatedVulnerabilities":[]}],"grade":"A","score":"100.00","as_of":"2026-10-18T03:34:22.372Z","grype_db_version":"2026-10-11T06:30:42.000Z"}