For OSS Maintainers: VEX Notice -------------------------------- If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users. Learn more and start using VEX: https://trivy.dev/docs/v0.72/guide/supply-chain/vex/repo#publishing-vex-documents To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. arangodb/enterprise-preview:3.12.13-nightly.20261023-deb-arm64v8 (ubuntu 24.04) =============================================================================== Total: 52 (UNKNOWN: 0, LOW: 12, MEDIUM: 40, HIGH: 0, CRITICAL: 0) +---------------------+-----------------+----------+----------+-------------------------+---------------+--------------------------------------------------------------+ | Library | Vulnerability | Severity | Status | Installed Version | Fixed Version | Title | +---------------------+-----------------+----------+----------+-------------------------+---------------+--------------------------------------------------------------+ | dash | CVE-2026-102473 | MEDIUM | affected | 0.5.12-6ubuntu5 | | dash: dash: Super-polynomial backtracking in pmatch when | | | | | | | | libc fnmatch is disabled | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-102473 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-102474 | | | | | dash: dash: Heap out-of-bounds write in conv_escape via | | | | | | | | undersized Unicode escape reservation... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-102474 | +---------------------+-----------------+----------+ +-------------------------+---------------+--------------------------------------------------------------+ | elfutils | CVE-2025-1352 | LOW | | 0.190-1.1ubuntu0.1 | | elfutils: GNU elfutils eu-readelf libdw_alloc.c | | | | | | | | __libdw_thread_tail memory corruption | | | | | | | | https://avd.aquasec.com/nvd/cve-2025-1352 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2025-1376 | | | | | elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr | | | | | | | | denial of service | | | | | | | | https://avd.aquasec.com/nvd/cve-2025-1376 | +---------------------+-----------------+----------+ +-------------------------+---------------+--------------------------------------------------------------+ | jq | CVE-2026-41256 | MEDIUM | | 1.7.1-3ubuntu0.24.04.2 | | jq: embedded NUL truncates top-level jq programs loaded with | | | | | | | | -f | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-41256 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-41257 | | | | | jq: signed-int overflow in stack_reallocate | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-41257 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-43895 | | | | | jq: embedded NUL in jq import paths causes local | | | | | | | | redaction-policy bypass and... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-43895 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-43896 | | | | | jq: stack overflow in recursive object merge | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-43896 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-44777 | | | | | jq: stack overflow in module loading on mutual include | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-44777 | +---------------------+-----------------+----------+ +-------------------------+---------------+--------------------------------------------------------------+ | libasm1t64 | CVE-2025-1352 | LOW | | 0.190-1.1ubuntu0.1 | | elfutils: GNU elfutils eu-readelf libdw_alloc.c | | | | | | | | __libdw_thread_tail memory corruption | | | | | | | | https://avd.aquasec.com/nvd/cve-2025-1352 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2025-1376 | | | | | elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr | | | | | | | | denial of service | | | | | | | | https://avd.aquasec.com/nvd/cve-2025-1376 | +---------------------+-----------------+----------+ +-------------------------+---------------+--------------------------------------------------------------+ | libc-bin | CVE-2026-18374 | MEDIUM | | 2.39-0ubuntu8.9 | | glibc: glibc: Heap buffer overflow via attacker-controlled | | | | | | | | fopen mode string | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-18374 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-89092 | | | | | glibc: nscd stack overflow leads to degraded DNS resolution | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-89092 | +---------------------+-----------------+ | | +---------------+--------------------------------------------------------------+ | libc6 | CVE-2026-18374 | | | | | glibc: glibc: Heap buffer overflow via attacker-controlled | | | | | | | | fopen mode string | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-18374 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-89092 | | | | | glibc: nscd stack overflow leads to degraded DNS resolution | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-89092 | +---------------------+-----------------+----------+ +-------------------------+---------------+--------------------------------------------------------------+ | libdw1t64 | CVE-2025-1352 | LOW | | 0.190-1.1ubuntu0.1 | | elfutils: GNU elfutils eu-readelf libdw_alloc.c | | | | | | | | __libdw_thread_tail memory corruption | | | | | | | | https://avd.aquasec.com/nvd/cve-2025-1352 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2025-1376 | | | | | elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr | | | | | | | | denial of service | | | | | | | | https://avd.aquasec.com/nvd/cve-2025-1376 | +---------------------+-----------------+ | | +---------------+--------------------------------------------------------------+ | libelf1t64 | CVE-2025-1352 | | | | | elfutils: GNU elfutils eu-readelf libdw_alloc.c | | | | | | | | __libdw_thread_tail memory corruption | | | | | | | | https://avd.aquasec.com/nvd/cve-2025-1352 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2025-1376 | | | | | elfutils: GNU elfutils eu-strip elf_strptr.c elf_strptr | | | | | | | | denial of service | | | | | | | | https://avd.aquasec.com/nvd/cve-2025-1376 | +---------------------+-----------------+----------+ +-------------------------+---------------+--------------------------------------------------------------+ | libexpat1 | CVE-2025-66382 | MEDIUM | | 2.6.1-2ubuntu0.6 | | libexpat: libexpat: Denial of service via crafted file | | | | | | | | processing | | | | | | | | https://avd.aquasec.com/nvd/cve-2025-66382 | +---------------------+-----------------+ | +-------------------------+---------------+--------------------------------------------------------------+ | libgnutls30t64 | CVE-2026-67693 | | | 3.8.3-1.1ubuntu3.6 | | gnutls: gnutls: Information disclosure via contradictory Key | | | | | | | | Usage and Extended Key Usage... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-67693 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-88647 | | | | | gnutls: gnutls: Information disclosure via hostname | | | | | | | | verification bypass | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-88647 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-95184 | | | | | gnutls: gnutls: legitimate user certificates incorrectly | | | | | | | | rejected causing denial of service | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-95184 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-95209 | | | | | gnutls: gnutls: legitimate CA certificates incorrectly | | | | | | | | rejected causing denial of service | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-95209 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-95210 | | | | | gnutls: gnutls: certificates with invalid extensions | | | | | | | | incorrectly accepted | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-95210 | +---------------------+-----------------+ | +-------------------------+---------------+--------------------------------------------------------------+ | libjq1 | CVE-2026-41256 | | | 1.7.1-3ubuntu0.24.04.2 | | jq: embedded NUL truncates top-level jq programs loaded with | | | | | | | | -f | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-41256 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-41257 | | | | | jq: signed-int overflow in stack_reallocate | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-41257 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-43895 | | | | | jq: embedded NUL in jq import paths causes local | | | | | | | | redaction-policy bypass and... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-43895 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-43896 | | | | | jq: stack overflow in recursive object merge | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-43896 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-44777 | | | | | jq: stack overflow in module loading on mutual include | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-44777 | +---------------------+-----------------+ | +-------------------------+---------------+--------------------------------------------------------------+ | libpcre2-8-0 | CVE-2026-103111 | | | 10.42-4ubuntu2.1 | | pcre2: pcre2: Out-of-bounds write via crafted regular | | | | | | | | expression | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-103111 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-86145 | | | | | pcre2: PCRE2: Out-of-bounds write allows arbitrary code | | | | | | | | execution via crafted regular expressions... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-86145 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-89156 | | | | | PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during | | | | | | | | JIT fallback | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-89156 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-89157 | | | | | pcre2: PCRE2: Out-of-bounds write via large pattern input | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-89157 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-89158 | | | | | PCRE2: PCRE2: Out-of-bounds write via integer overflow on | | | | | | | | 32-bit platforms | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-89158 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-89160 | | | | | pcre2: PCRE2: Denial of Service via out-of-bounds read | | | | | | | | during invalid UTF matching... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-89160 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-89161 | | | | | pcre2: PCRE2: Memory corruption vulnerability in | | | | | | | | pcre2_jit_match | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-89161 | +---------------------+-----------------+ | +-------------------------+---------------+--------------------------------------------------------------+ | libsasl2-2 | CVE-2026-107161 | | | 2.1.28+dfsg1-5ubuntu3.1 | | cyrus-sasl: Heap buffer overflow in cyrus-sasl | | | | | | | | add_to_challenge() allows malicious server to crash... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-107161 | +---------------------+ | | | +---------------+ | | libsasl2-modules-db | | | | | | | | | | | | | | | | | | | | | | | +---------------------+-----------------+----------+ +-------------------------+---------------+--------------------------------------------------------------+ | libsystemd0 | CVE-2026-40228 | LOW | | 255.4-1ubuntu8.17 | | systemd: systemd-journald: Unintended output to user | | | | | | | | terminals via logger command | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-40228 | +---------------------+ | | | +---------------+ | | libudev1 | | | | | | | | | | | | | | | | | | | | | | | +---------------------+-----------------+ | +-------------------------+---------------+--------------------------------------------------------------+ | login | CVE-2024-56433 | | | 1:4.13+dfsg1-4ubuntu3.2 | | shadow-utils: Default subordinate ID configuration in | | | | | | | | /etc/login.defs could lead to compromise | | | | | | | | https://avd.aquasec.com/nvd/cve-2024-56433 | +---------------------+ | | | +---------------+ | | passwd | | | | | | | | | | | | | | | | | | | | | | | +---------------------+-----------------+----------+ +-------------------------+---------------+--------------------------------------------------------------+ | tar | CVE-2026-18477 | MEDIUM | | 1.35+dfsg-3ubuntu0.4 | | tar: tar: TOCTOU in incremental dumpdir 'X' rename handling | | | | | | | | allows restore path... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-18477 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-18508 | | | | | tar: tar: --one-top-level hardlink targets not confined to | | | | | | | | top-level directory enabling arbitrary... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-18508 | +---------------------+-----------------+ | +-------------------------+---------------+--------------------------------------------------------------+ | vim | CVE-2026-51400 | | | 2:9.1.0016-1ubuntu7.20 | | vim: Vim: Arbitrary code execution via vms_fixfilename() | | | | | | | | function | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-51400 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-51401 | | | | | vim: Vim: Arbitrary code execution via vms_fixfilename() | | | | | | | | function | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-51401 | +---------------------+-----------------+ | | +---------------+--------------------------------------------------------------+ | vim-common | CVE-2026-51400 | | | | | vim: Vim: Arbitrary code execution via vms_fixfilename() | | | | | | | | function | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-51400 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-51401 | | | | | vim: Vim: Arbitrary code execution via vms_fixfilename() | | | | | | | | function | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-51401 | +---------------------+-----------------+ | | +---------------+--------------------------------------------------------------+ | vim-runtime | CVE-2026-51400 | | | | | vim: Vim: Arbitrary code execution via vms_fixfilename() | | | | | | | | function | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-51400 | | +-----------------+ | | +---------------+--------------------------------------------------------------+ | | CVE-2026-51401 | | | | | vim: Vim: Arbitrary code execution via vms_fixfilename() | | | | | | | | function | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-51401 | +---------------------+-----------------+ | +-------------------------+---------------+--------------------------------------------------------------+ | zlib1g | CVE-2026-85091 | | | 1:1.3.dfsg-3.1ubuntu2.2 | | zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer | | | | | | | | overflow vul ...... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-85091 | +---------------------+-----------------+----------+----------+-------------------------+---------------+--------------------------------------------------------------+ Node.js (node-pkg) ================== Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0) +--------------------+----------------+----------+--------+-------------------+-----------------+--------------------------------------------------------+ | Library | Vulnerability | Severity | Status | Installed Version | Fixed Version | Title | +--------------------+----------------+----------+--------+-------------------+-----------------+--------------------------------------------------------+ | joi (package.json) | CVE-2026-48038 | MEDIUM | fixed | 14.3.1 | 18.2.1, 17.13.4 | joi: joi: Denial of Service via uncaught RangeError on | | | | | | | | deeply nested input... | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-48038 | | +----------------+ | | +-----------------+--------------------------------------------------------+ | | CVE-2026-90771 | | | | 17.13.8, 18.2.9 | joi: joi: Prototype Pollution via custom messages | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-90771 | +--------------------+----------------+----------+--------+-------------------+-----------------+--------------------------------------------------------+ usr/bin/arangodb (gobinary) =========================== Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0) +---------+-----------------+----------+--------+-------------------+-----------------+-------------------------------------------------------------+ | Library | Vulnerability | Severity | Status | Installed Version | Fixed Version | Title | +---------+-----------------+----------+--------+-------------------+-----------------+-------------------------------------------------------------+ | stdlib | CVE-2026-111943 | HIGH | fixed | v1.26.9 | 1.26.10, 1.27.3 | crypto/x509: golang: crypto/x509: Man-in-the-middle attacks | | | | | | | | via untrusted intermediate certificates | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-111943 | +---------+-----------------+----------+--------+-------------------+-----------------+-------------------------------------------------------------+ usr/sbin/rclone-arangodb (gobinary) =================================== Total: 2 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0) +---------------------+-----------------+----------+----------+-------------------+-----------------+-------------------------------------------------------------+ | Library | Vulnerability | Severity | Status | Installed Version | Fixed Version | Title | +---------------------+-----------------+----------+----------+-------------------+-----------------+-------------------------------------------------------------+ | golang.org/x/crypto | GO-2026-5932 | UNKNOWN | affected | v0.57.0 | | The golang.org/x/crypto/openpgp package is unmaintained, | | | | | | | | unsafe by design, and has known security... | +---------------------+-----------------+----------+----------+-------------------+-----------------+-------------------------------------------------------------+ | stdlib | CVE-2026-111943 | HIGH | fixed | v1.26.9 | 1.26.10, 1.27.3 | crypto/x509: golang: crypto/x509: Man-in-the-middle attacks | | | | | | | | via untrusted intermediate certificates | | | | | | | | https://avd.aquasec.com/nvd/cve-2026-111943 | +---------------------+-----------------+----------+----------+-------------------+-----------------+-------------------------------------------------------------+