{"cves":[{"id":"CVE-2026-2597","published":"2026-02-27T00:16:00","updated_at":"2026-03-04T15:14:16.882294+00:00","description":"\nCrypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap\nbuffer overflow in the XS function random_bytes().\nThe function does not validate that the length parameter is non-negative.\nIf a negative value (e.g. -1) is supplied, the expression length + 1u\ncauses an integer wraparound, resulting in a zero-byte allocation. The\nsubsequent call to chosen random function (e.g. getrandom) passes the\noriginal negative value, which is implicitly converted to a large unsigned\nvalue (typically SIZE_MAX). This can result in writes beyond the allocated\nbuffer, leading to heap memory corruption and application crash (denial of\nservice).\nIn common usage, the length argument is typically hardcoded by the caller,\nwhich reduces the likelihood of attacker-controlled exploitation.\nApplications that pass untrusted input to this parameter may be affected.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-2597"],"bugs":[""],"patches":{"libcrypt-sysrandom-xs-perl":[]},"tags":{},"packages":[{"name":"libcrypt-sysrandom-xs-perl","source":"https://ubuntu.com/security/cve?package=libcrypt-sysrandom-xs-perl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libcrypt-sysrandom-xs-perl","debian":"https://tracker.debian.org/pkg/libcrypt-sysrandom-xs-perl","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.011-1","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-3284","published":"2026-02-27T00:00:00","updated_at":"2026-09-11T07:04:05.443079+00:00","description":"\nA vulnerability was found in libvips 8.19.0. Impacted is the function\nvips_extract_area_build of the file libvips/conversion/extract.c. The\nmanipulation of the argument extract_area results in integer overflow. The\nattack requires a local approach. The exploit has been made public and\ncould be used. The patch is identified as\n24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. It is advisable to implement a\npatch to correct this issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":3.3,"baseSeverity":"LOW"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":1.9,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-3284","https://github.com/libvips/libvips/issues/4879","https://github.com/libvips/libvips/pull/4887","https://github.com/libvips/libvips/","https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70","https://github.com/libvips/libvips/issues/4879#issue-3944211794","https://vuldb.com/?ctiid.348013","https://vuldb.com/?id.348013","https://vuldb.com/?submit.758864"],"bugs":[""],"patches":{"vips":[]},"tags":{},"packages":[{"name":"vips","source":"https://ubuntu.com/security/cve?package=vips","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=vips","debian":"https://tracker.debian.org/pkg/vips","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-3283","published":"2026-02-27T00:00:00","updated_at":"2026-07-10T20:05:42.323828+00:00","description":"\nA vulnerability has been found in libvips 8.19.0. This issue affects the\nfunction vips_extract_band_build of the file libvips/conversion/extract.c.\nThe manipulation of the argument extract_band leads to out-of-bounds read.\nThe attack needs to be performed locally. The exploit has been disclosed to\nthe public and may be used. The identifier of the patch is\n24795bb3d19d84f7b6f5ed86451ad556c8f2fe70. To fix this issue, it is\nrecommended to deploy a patch.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":1.9,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-3283","https://github.com/libvips/libvips/issues/4880","https://github.com/libvips/libvips/pull/4887","https://github.com/libvips/libvips/","https://github.com/libvips/libvips/commit/24795bb3d19d84f7b6f5ed86451ad556c8f2fe70","https://github.com/libvips/libvips/issues/4880#issue-3944214985","https://vuldb.com/?ctiid.348012","https://vuldb.com/?id.348012","https://vuldb.com/?submit.758863"],"bugs":[""],"patches":{"vips":[]},"tags":{},"packages":[{"name":"vips","source":"https://ubuntu.com/security/cve?package=vips","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=vips","debian":"https://tracker.debian.org/pkg/vips","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-3282","published":"2026-02-27T00:00:00","updated_at":"2026-07-10T20:06:12.885994+00:00","description":"\nA flaw has been found in libvips 8.19.0. This vulnerability affects the\nfunction vips_unpremultiply_build of the file\nlibvips/conversion/unpremultiply.c. Executing a manipulation of the\nargument alpha_band can lead to out-of-bounds read. The attack needs to be\nlaunched locally. The exploit has been published and may be used. This\npatch is called 7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91. A patch should be\napplied to remediate this issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":3.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":1.9,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-3282","https://github.com/libvips/libvips/issues/4881","https://github.com/libvips/libvips/pull/4886","https://github.com/libvips/libvips/","https://github.com/libvips/libvips/commit/7215ead1e0cd7d3703cc4f5fca06d7d0f4c22b91","https://github.com/libvips/libvips/issues/4881#issue-3944216443","https://vuldb.com/?ctiid.348011","https://vuldb.com/?id.348011","https://vuldb.com/?submit.758862"],"bugs":[""],"patches":{"vips":[]},"tags":{},"packages":[{"name":"vips","source":"https://ubuntu.com/security/cve?package=vips","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=vips","debian":"https://tracker.debian.org/pkg/vips","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-3281","published":"2026-02-27T00:00:00","updated_at":"2026-09-11T07:02:38.293382+00:00","description":"\nA vulnerability was detected in libvips 8.19.0. This affects the function\nvips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a\nmanipulation of the argument index results in heap-based buffer overflow.\nThe attack must be initiated from a local position. The exploit is now\npublic and may be used. The patch is named\nfd28c5463697712cb0ab116a2c55e4f4d92c4088. It is suggested to install a\npatch to address this issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseMetrics":{"exploitabilityMetrics":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":1.9,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-3281","https://github.com/libvips/libvips/issues/4878","https://github.com/libvips/libvips/pull/4895","https://github.com/libvips/libvips/","https://github.com/libvips/libvips/commit/fd28c5463697712cb0ab116a2c55e4f4d92c4088","https://github.com/libvips/libvips/issues/4878#issue-3944209102","https://vuldb.com/?ctiid.348010","https://vuldb.com/?id.348010","https://vuldb.com/?submit.758861"],"bugs":[""],"patches":{"vips":[]},"tags":{},"packages":[{"name":"vips","source":"https://ubuntu.com/security/cve?package=vips","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=vips","debian":"https://tracker.debian.org/pkg/vips","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-28372","published":"2026-02-27T00:00:00","updated_at":"2026-06-08T18:54:46.577239+00:00","description":"\ntelnetd in GNU inetutils through 2.7 allows privilege escalation that can\nbe exploited by abusing systemd service credentials support added to the\nlogin(1) implementation of util-linux in release 2.40. This is related to\nclient control over the CREDENTIALS_DIRECTORY environment variable, and\nrequires an unprivileged local user to create a login.noauth file.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"This is only an issue when used with util-linux 2.40+ which\nadded support for systemd service credentials\nNoble and earlier shipped with util-linux < 2.40 and are not\nvulnerable to this issue.\n\nIn addition, in Ubuntu noble and earlier, the login binary is\nproduced by the shadow package, not the util-linux package. The\nlogin binary switched to being built from the util-linux package\nin questing and later.\n\nSee discussion here for more possible issues:\nhttps://www.openwall.com/lists/oss-security/2026/02/24/1\n\nShould also include all the hardening commits from here:\nhttps://cgit.git.savannah.gnu.org/cgit/inetutils.git/log/telnetd"}],"codename":null,"priority":"medium","cvss3":7.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.4,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-28372","https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00000.html","https://git.hadrons.org/cgit/debian/pkgs/inetutils.git/commit/?id=3953943d8296310485f98963883a798545ab9a6c","https://lists.gnu.org/archive/html/bug-inetutils/2026-02/msg00012.html","https://www.openwall.com/lists/oss-security/2026/02/24/1","https://ubuntu.com/security/notices/USN-8387-1"],"bugs":[""],"patches":{"inetutils":["upstream: https://cgit.git.savannah.gnu.org/cgit/inetutils.git/commit/?id=4db2f19f4caac03c7f4da6363c140bd70df31386"]},"tags":{},"packages":[{"name":"inetutils","source":"https://ubuntu.com/security/cve?package=inetutils","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=inetutils","debian":"https://tracker.debian.org/pkg/inetutils","statuses":[{"release_codename":"xenial","status":"released","description":"2:1.9.4-1ubuntu0.1~esm6","component":null,"pocket":"esm-apps-legacy"},{"release_codename":"upstream","status":"released","description":"2:2.7-3","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"2:1.9.4-3ubuntu0.1+esm5","component":null,"pocket":"esm-apps"},{"release_codename":"focal","status":"released","description":"2:1.9.4-11ubuntu0.2+esm4","component":null,"pocket":"esm-apps"},{"release_codename":"jammy","status":"released","description":"2:2.2-2ubuntu0.2+esm1","component":null,"pocket":"esm-apps"},{"release_codename":"noble","status":"released","description":"2:2.5-3ubuntu4.2","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"2:2.6-1ubuntu3.2","component":null,"pocket":"security"},{"release_codename":"resolute","status":"released","description":"2:2.7-2ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"2:1.9.2-1ubuntu0.1~esm4","component":null,"pocket":"esm-infra-legacy"}]}],"notices_ids":["USN-8387-1"],"notices":[{"id":"USN-8387-1","title":"Inetutils vulnerabilities","summary":"Several security issues were fixed in Inetutils.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2026-06-04T23:16:19.105678","description":"It was discovered that the Inetutils telnet daemon incorrectly handled\nthe CREDENTIALS_DIRECTORY environment variable. An attacker could possibly\nuse this issue to escalate privileges. (CVE-2026-28372)\n\nIt was discovered that the Inetutils telnet daemon did not properly\nvalidate buffer bounds when processing LINEMODE SLC suboptions. An attacker\ncould possibly use this issue to cause a denial of service or execute\narbitrary code. (CVE-2026-32746)\n\nIt was discovered that the Inetutils telnet client incorrectly handled the\nNEW_ENVIRON SEND USERVAR option. An attacker could possibly use this issue\nto read arbitrary environment variables. (CVE-2026-32772)","is_hidden":false,"release_packages":{"bionic":[{"name":"inetutils","version":"2:1.9.4-3ubuntu0.1+esm5","description":"Collection of common network programs","is_source":true},{"name":"inetutils-ftp","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-ftpd","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-inetd","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-ping","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-syslogd","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-talk","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-talkd","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-telnet","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-telnetd","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-tools","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-traceroute","version":"2:1.9.4-3ubuntu0.1+esm5","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"}],"focal":[{"name":"inetutils","version":"2:1.9.4-11ubuntu0.2+esm4","description":"Collection of common network programs","is_source":true},{"name":"inetutils-ftp","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-ftpd","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-inetd","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-ping","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-syslogd","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-talk","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-talkd","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-telnet","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-telnetd","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-tools","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-traceroute","version":"2:1.9.4-11ubuntu0.2+esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"}],"jammy":[{"name":"inetutils","version":"2:2.2-2ubuntu0.2+esm1","description":"Collection of common network programs","is_source":true},{"name":"inetutils-ftp","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-ftpd","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-inetd","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-ping","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-syslogd","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-talk","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-talkd","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-telnet","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-telnetd","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-tools","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"},{"name":"inetutils-traceroute","version":"2:2.2-2ubuntu0.2+esm1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps"}],"noble":[{"name":"inetutils","version":"2:2.5-3ubuntu4.2","description":"Collection of common network programs","is_source":true},{"name":"inetutils-ftp","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-ftpd","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-inetd","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-ping","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-syslogd","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-talk","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-talkd","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-telnet","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-telnetd","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-tools","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"inetutils-traceroute","version":"2:2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"telnet","version":"0.17+2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"},{"name":"telnetd","version":"0.17+2.5-3ubuntu4.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.5-3ubuntu4.2","pocket":"security"}],"questing":[{"name":"inetutils","version":"2:2.6-1ubuntu3.2","description":"Collection of common network programs","is_source":true},{"name":"inetutils-ftp","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-ftpd","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-inetd","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-ping","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-syslogd","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-talk","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-talkd","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-telnet","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-telnetd","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-tools","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"inetutils-traceroute","version":"2:2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"telnet","version":"0.17+2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"},{"name":"telnetd","version":"0.17+2.6-1ubuntu3.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.6-1ubuntu3.2","pocket":"security"}],"resolute":[{"name":"inetutils","version":"2:2.7-2ubuntu1.1","description":"Collection of common network programs","is_source":true},{"name":"inetutils-ftp","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-ftpd","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-inetd","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-ping","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-syslogd","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-talk","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-talkd","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-telnet","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-telnetd","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-tools","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"inetutils-traceroute","version":"2:2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"telnet","version":"0.17+2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"},{"name":"telnetd","version":"0.17+2.7-2ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":"https://launchpad.net/ubuntu/+source/inetutils/2:2.7-2ubuntu1.1","pocket":"security"}],"trusty":[{"name":"inetutils","version":"2:1.9.2-1ubuntu0.1~esm4","description":"Collection of common network programs","is_source":true},{"name":"inetutils-ftp","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-ftpd","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-inetd","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-ping","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-syslogd","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-talk","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-talkd","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-telnet","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-telnetd","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-tools","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"},{"name":"inetutils-traceroute","version":"2:1.9.2-1ubuntu0.1~esm4","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-infra-legacy"}],"xenial":[{"name":"inetutils","version":"2:1.9.4-1ubuntu0.1~esm6","description":"Collection of common network programs","is_source":true},{"name":"inetutils-ftp","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-ftpd","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-inetd","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-ping","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-syslogd","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-talk","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-talkd","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-telnet","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-telnetd","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-tools","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"},{"name":"inetutils-traceroute","version":"2:1.9.4-1ubuntu0.1~esm6","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/inetutils","version_link":null,"pocket":"esm-apps-legacy"}]},"type":"USN","cves_ids":["CVE-2026-32746","CVE-2026-32772","CVE-2026-28372"]}]},{"id":"CVE-2026-28370","published":"2026-02-27T00:00:00","updated_at":"2026-02-27T18:21:07.911201+00:00","description":"\nIn the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and\n15.0.0, a user allowed to access the Vitrage API may trigger code execution\non the Vitrage service host as the user the Vitrage service runs under.\nThis may result in unauthorized access to the host and further compromise\nof the Vitrage service. All deployments exposing the Vitrage API are\naffected. This occurs in _create_query_function in vitrage/graph/query.py.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":9.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-28370","https://github.com/openstack/vitrage/blob/a1f86950e1314b0c740f9cd9b7e9dbab7d02af51/vitrage/graph/query.py#L70","https://storyboard.openstack.org/#%21/story/2011539"],"bugs":[""],"patches":{"vitrage":[]},"tags":{},"packages":[{"name":"vitrage","source":"https://ubuntu.com/security/cve?package=vitrage","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=vitrage","debian":"https://tracker.debian.org/pkg/vitrage","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-28364","published":"2026-02-27T00:00:00","updated_at":"2026-02-27T18:21:07.911201+00:00","description":"\nIn OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal\ndeserialization (runtime/intern.c) enables remote code execution through a\nmulti-phase attack chain. The vulnerability stems from missing bounds\nvalidation in the readblock() function, which performs unbounded memcpy()\noperations using attacker-controlled lengths from crafted Marshal data.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.9,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":7.9,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-28364","https://osv.dev/vulnerability/OSEC-2026-01","https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json"],"bugs":[""],"patches":{"ocaml":[]},"tags":{},"packages":[{"name":"ocaml","source":"https://ubuntu.com/security/cve?package=ocaml","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ocaml","debian":"https://tracker.debian.org/pkg/ocaml","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2025-40932","published":"2026-02-27T00:00:00","updated_at":"2026-03-01T11:03:01.703413+00:00","description":"\nApache::SessionX versions through 2.01 for Perl create insecure session id.\nApache::SessionX generates session ids insecurely. The default session id\ngenerator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with\nthe built-in rand() function, the epoch time, and the PID. The PID will\ncome from a small set of numbers, and the epoch time may be guessed, if it\nis not leaked from the HTTP Date header. The built-in rand function is\nunsuitable for cryptographic usage. Predicable session ids could allow an\nattacker to gain access to systems.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.2,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-40932","https://lists.security.metacpan.org/cve-announce/msg/37425045/","https://metacpan.org/release/GRICHTER/Apache-SessionX-2.01/source/SessionX/Generate/MD5.pm#L29"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930660"],"patches":{"libapache-sessionx-perl":[]},"tags":{},"packages":[{"name":"libapache-sessionx-perl","source":"https://ubuntu.com/security/cve?package=libapache-sessionx-perl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libapache-sessionx-perl","debian":"https://tracker.debian.org/pkg/libapache-sessionx-perl","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2021-4456","published":"2026-02-27T00:00:00","updated_at":"2026-03-19T19:52:35.860651+00:00","description":"\nNet::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR\naddresses, which may have unspecified impact.\nThe functions `addr2cidr` and `cidrlookup` may return leading zeros in a\nCIDR string, which may in turn be parsed as octal numbers by subsequent\nusers. In some cases an attacker may be able to leverage this to bypass\naccess controls based on IP addresses.\nThe documentation advises validating untrusted CIDR strings with the\n`cidrvalidate` function. However, this mitigation is optional and not\nenforced by default. In practice, users may call `addr2cidr` or\n`cidrlookup` with untrusted input and without validation, incorrectly\nassuming that this is safe.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":6.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2021-4456","https://lists.security.metacpan.org/cve-announce/msg/37425715/","https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/","https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10","https://metacpan.org/dist/Net-CIDR/changes","https://ubuntu.com/security/notices/USN-8110-1"],"bugs":[""],"patches":{"libnet-cidr-perl":["upstream: https://github.com/svarshavchik/Net-CIDR/commit/e3648c6bc6bdd018f90cca4149c467017d42bd10"]},"tags":{},"packages":[{"name":"libnet-cidr-perl","source":"https://ubuntu.com/security/cve?package=libnet-cidr-perl","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libnet-cidr-perl","debian":"https://tracker.debian.org/pkg/libnet-cidr-perl","statuses":[{"release_codename":"questing","status":"not-affected","description":"0.25-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.25-1","component":null,"pocket":"security"},{"release_codename":"bionic","status":"released","description":"0.18-1ubuntu0.1~esm2","component":null,"pocket":"esm-infra"},{"release_codename":"focal","status":"released","description":"0.20-1ubuntu0.1~esm2","component":null,"pocket":"esm-infra"},{"release_codename":"jammy","status":"released","description":"0.21-1ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"0.21-2ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"trusty","status":"released","description":"0.17-1ubuntu0.14.04.1~esm2","component":null,"pocket":"esm-infra-legacy"},{"release_codename":"xenial","status":"released","description":"0.17-1ubuntu0.16.04.1~esm2","component":null,"pocket":"esm-infra"}]}],"notices_ids":["USN-8110-1"],"notices":[{"id":"USN-8110-1","title":"Net-CIDR vulnerability","summary":"Net-CIDR could allow unintended access to network services.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2026-03-18T19:40:53.861807","description":"Dave Rolsky discovered that Net-CIDR did not properly sanitize IP\naddresses. An attacker could possibly use this to bypass IP-based\nrestrictions.","is_hidden":false,"release_packages":{"bionic":[{"name":"libnet-cidr-perl","version":"0.18-1ubuntu0.1~esm2","description":"module for merging IPv4 or IPv6 CIDR address ranges","is_source":true},{"name":"libnet-cidr-perl","version":"0.18-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libnet-cidr-perl","version_link":null,"pocket":"esm-infra"}],"focal":[{"name":"libnet-cidr-perl","version":"0.20-1ubuntu0.1~esm2","description":"module for merging IPv4 or IPv6 CIDR address ranges","is_source":true},{"name":"libnet-cidr-perl","version":"0.20-1ubuntu0.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libnet-cidr-perl","version_link":null,"pocket":"esm-infra"}],"jammy":[{"name":"libnet-cidr-perl","version":"0.21-1ubuntu0.2","description":"module for merging IPv4 or IPv6 CIDR address ranges","is_source":true},{"name":"libnet-cidr-perl","version":"0.21-1ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libnet-cidr-perl","version_link":"https://launchpad.net/ubuntu/+source/libnet-cidr-perl/0.21-1ubuntu0.2","pocket":"security"}],"noble":[{"name":"libnet-cidr-perl","version":"0.21-2ubuntu0.2","description":"module for merging IPv4 or IPv6 CIDR address ranges","is_source":true},{"name":"libnet-cidr-perl","version":"0.21-2ubuntu0.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libnet-cidr-perl","version_link":"https://launchpad.net/ubuntu/+source/libnet-cidr-perl/0.21-2ubuntu0.2","pocket":"security"}],"trusty":[{"name":"libnet-cidr-perl","version":"0.17-1ubuntu0.14.04.1~esm2","description":"module for merging IPv4 or IPv6 CIDR address ranges","is_source":true},{"name":"libnet-cidr-perl","version":"0.17-1ubuntu0.14.04.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libnet-cidr-perl","version_link":null,"pocket":"esm-infra-legacy"}],"xenial":[{"name":"libnet-cidr-perl","version":"0.17-1ubuntu0.16.04.1~esm2","description":"module for merging IPv4 or IPv6 CIDR address ranges","is_source":true},{"name":"libnet-cidr-perl","version":"0.17-1ubuntu0.16.04.1~esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/libnet-cidr-perl","version_link":null,"pocket":"esm-infra"}]},"type":"USN","cves_ids":["CVE-2021-4456"]}]},{"id":"CVE-2026-22206","published":"2026-02-26T21:28:00","updated_at":"2026-07-10T19:29:10.444716+00:00","description":"\nSPIP versions prior to 4.4.10 contain a SQL injection vulnerability that\nallows authenticated low-privilege users to execute arbitrary SQL queries\nby manipulating union-based injection techniques. Attackers can exploit\nthis SQL injection flaw combined with PHP tag processing to achieve remote\ncode execution on the server.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":8.8,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.7,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-22206","https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html","https://git.spip.net/spip/spip","https://www.vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tags"],"bugs":[""],"patches":{"spip":[]},"tags":{},"packages":[{"name":"spip","source":"https://ubuntu.com/security/cve?package=spip","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=spip","debian":"https://tracker.debian.org/pkg/spip","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-22205","published":"2026-02-26T21:28:00","updated_at":"2026-07-10T19:29:10.444716+00:00","description":"\nSPIP versions prior to 4.4.10 contain an authentication bypass\nvulnerability caused by PHP type juggling that allows unauthenticated\nattackers to access protected information. Attackers can exploit loose type\ncomparisons in authentication logic to bypass login verification and\nretrieve sensitive internal data.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":8.7,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-22205","https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html","https://git.spip.net/spip/spip","https://www.vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tags"],"bugs":[""],"patches":{"spip":[]},"tags":{},"packages":[{"name":"spip","source":"https://ubuntu.com/security/cve?package=spip","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=spip","debian":"https://tracker.debian.org/pkg/spip","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-27141","published":"2026-02-26T20:31:00","updated_at":"2026-06-18T20:09:16.133281+00:00","description":"\nDue to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a\nrunning server to panic","ubuntu_description":"","notes":[{"author":"octagalland","note":"google-guest-agent, adsys, juju-core and lxd contain a\nvendored\ncopy of golang-golang-x-net"},{"author":"mdeslaur","note":"containerd contains a vendored copy of golang-golang-x-net"}],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-27141","https://github.com/golang/go/issues/77652","https://go.dev/cl/746180","https://go.dev/issue/77652","https://nvd.nist.gov/vuln/detail/CVE-2026-27141","https://pkg.go.dev/vuln/GO-2026-4559","https://ubuntu.com/security/notices/USN-8430-1"],"bugs":[""],"patches":{"golang-golang-x-net":["upstream: https://github.com/golang/net/commit/19f580fd686a6bb31d4af15febe789827169bc26"],"google-guest-agent":[],"containerd":[],"golang-golang-x-net-dev":[],"adsys":[],"juju-core":[],"lxd":[]},"tags":{},"packages":[{"name":"adsys","source":"https://ubuntu.com/security/cve?package=adsys","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=adsys","debian":"https://tracker.debian.org/pkg/adsys","statuses":[{"release_codename":"resolute","status":"released","description":"0.16.4ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"containerd","source":"https://ubuntu.com/security/cve?package=containerd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=containerd","debian":"https://tracker.debian.org/pkg/containerd","statuses":[{"release_codename":"resolute","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"golang-golang-x-net","source":"https://ubuntu.com/security/cve?package=golang-golang-x-net","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=golang-golang-x-net","debian":"https://tracker.debian.org/pkg/golang-golang-x-net","statuses":[{"release_codename":"resolute","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"debian: Vulnerable code introduced later","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"golang-golang-x-net-dev","source":"https://ubuntu.com/security/cve?package=golang-golang-x-net-dev","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=golang-golang-x-net-dev","debian":"https://tracker.debian.org/pkg/golang-golang-x-net-dev","statuses":[{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"google-guest-agent","source":"https://ubuntu.com/security/cve?package=google-guest-agent","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=google-guest-agent","debian":"https://tracker.debian.org/pkg/google-guest-agent","statuses":[{"release_codename":"resolute","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"juju-core","source":"https://ubuntu.com/security/cve?package=juju-core","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=juju-core","debian":"https://tracker.debian.org/pkg/juju-core","statuses":[{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"lxd","source":"https://ubuntu.com/security/cve?package=lxd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=lxd","debian":"https://tracker.debian.org/pkg/lxd","statuses":[{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"xenial","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-8430-1"],"notices":[{"id":"USN-8430-1","title":"ADSys vulnerabilities","summary":"Several security issues were fixed in ADSys.","instructions":"In general, a standard system update will make all the necessary changes.","references":[],"published":"2026-06-15T16:19:26.499909","description":"It was discovered that ADSys did not properly handle certain HTTP/2 frames.\nA remote attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-27141)\n\nIt was discovered that ADSys did not properly handle certain HTTP/2\nSETTINGS frames. A remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2026-33814)","is_hidden":false,"release_packages":{"focal":[{"name":"adsys","version":"0.9.2~20.04.2ubuntu0.1+esm2","description":"Active Directory Group Policy client","is_source":true},{"name":"adsys","version":"0.9.2~20.04.2ubuntu0.1+esm2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":null,"pocket":"esm-infra"},{"name":"adsys-windows","version":"0.9.2~20.04.2ubuntu0.1+esm2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":null,"pocket":"esm-infra"}],"jammy":[{"name":"adsys","version":"0.16.3~22.04.2ubuntu0.22.04.1","description":"Active Directory Group Policy client","is_source":true},{"name":"adsys","version":"0.16.3~22.04.2ubuntu0.22.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":"https://launchpad.net/ubuntu/+source/adsys/0.16.3~22.04.2ubuntu0.22.04.1","pocket":"security"},{"name":"adsys-windows","version":"0.16.3~22.04.2ubuntu0.22.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":"https://launchpad.net/ubuntu/+source/adsys/0.16.3~22.04.2ubuntu0.22.04.1","pocket":"security"}],"noble":[{"name":"adsys","version":"0.16.3~24.04.2ubuntu0.24.04.1","description":"Active Directory Group Policy client","is_source":true},{"name":"adsys","version":"0.16.3~24.04.2ubuntu0.24.04.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":"https://launchpad.net/ubuntu/+source/adsys/0.16.3~24.04.2ubuntu0.24.04.1","pocket":"security"},{"name":"adsys-windows","version":"0.16.3~24.04.2ubuntu0.24.04.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":"https://launchpad.net/ubuntu/+source/adsys/0.16.3~24.04.2ubuntu0.24.04.1","pocket":"security"}],"questing":[{"name":"adsys","version":"0.16.3ubuntu0.25.10.2","description":"Active Directory Group Policy client","is_source":true},{"name":"adsys","version":"0.16.3ubuntu0.25.10.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":"https://launchpad.net/ubuntu/+source/adsys/0.16.3ubuntu0.25.10.2","pocket":"security"},{"name":"adsys-windows","version":"0.16.3ubuntu0.25.10.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":"https://launchpad.net/ubuntu/+source/adsys/0.16.3ubuntu0.25.10.2","pocket":"security"}],"resolute":[{"name":"adsys","version":"0.16.4ubuntu1.1","description":"Active Directory Group Policy client","is_source":true},{"name":"adsys","version":"0.16.4ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":"https://launchpad.net/ubuntu/+source/adsys/0.16.4ubuntu1.1","pocket":"security"},{"name":"adsys-windows","version":"0.16.4ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/adsys","version_link":"https://launchpad.net/ubuntu/+source/adsys/0.16.4ubuntu1.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2026-33814","CVE-2026-27141"]}]},{"id":"CVE-2026-28296","published":"2026-02-26T16:24:00","updated_at":"2026-03-23T14:08:20.100566+00:00","description":"\nA flaw was found in the FTP GVfs backend. A remote attacker could exploit\nthis input validation vulnerability by supplying specially crafted file\npaths containing carriage return and line feed (CRLF) sequences. These\nunsanitized sequences allow the attacker to terminate intended FTP commands\nand inject arbitrary FTP commands, potentially leading to arbitrary code\nexecution or other severe impacts.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":4.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-28296","https://access.redhat.com/security/cve/CVE-2026-28296","https://ubuntu.com/security/notices/USN-8114-1"],"bugs":["https://gitlab.gnome.org/GNOME/gvfs/-/issues/833","https://bugzilla.redhat.com/show_bug.cgi?id=2443003"],"patches":{"gvfs":["upstream: https://gitlab.gnome.org/GNOME/gvfs/-/commit/21dda19047b86c3e92fae668eb9dc80e33ca71fd","upstream: https://gitlab.gnome.org/GNOME/gvfs/-/commit/2916e8deea297f300056265530c7ca3ea443775f","upstream: https://gitlab.gnome.org/GNOME/gvfs/-/commit/447ee8a32fe56529bf92c0a733f6d35e724c2689"]},"tags":{},"packages":[{"name":"gvfs","source":"https://ubuntu.com/security/cve?package=gvfs","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gvfs","debian":"https://tracker.debian.org/pkg/gvfs","statuses":[{"release_codename":"resolute","status":"not-affected","description":"1.59.90-3","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.48.2-0ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.59.90-1","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"1.54.4-0ubuntu1~24.04.2","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"1.57.2-2ubuntu5.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-8114-1"],"notices":[{"id":"USN-8114-1","title":"GVfs vulnerabilities","summary":"Several security issues were fixed in GVfs.","instructions":"After a standard system update you need to restart your session to make\nall the necessary changes.","references":[],"published":"2026-03-23T12:53:19.912255","description":"It was discovered that the GVfs FTP backend incorrectly handled IP\naddresses and ports returned by passive mode responses. A malicious remote\nserver could possibly use this issue to help scan for open ports.\n(CVE-2026-28295)\n\nIt was discovered that the GVfs FTP backend incorrectly handled crafted\nfile paths. A remote attacker could use this issue to terminate or inject\narbitrary FTP commands, or possibly execute arbitrary code.\n(CVE-2026-28296)","is_hidden":false,"release_packages":{"jammy":[{"name":"gvfs","version":"1.48.2-0ubuntu1.1","description":"Userspace virtual file system","is_source":true},{"name":"gvfs","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-backends","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-common","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-daemons","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-fuse","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-libs","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"}],"noble":[{"name":"gvfs","version":"1.54.4-0ubuntu1~24.04.2","description":"Userspace virtual file system","is_source":true},{"name":"gvfs","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-backends","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-common","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-daemons","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-fuse","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-libs","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"}],"questing":[{"name":"gvfs","version":"1.57.2-2ubuntu5.1","description":"Userspace virtual file system","is_source":true},{"name":"gvfs","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-backends","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-common","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-daemons","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-fuse","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-libs","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2026-28296","CVE-2026-28295"]}]},{"id":"CVE-2026-28295","published":"2026-02-26T16:24:00","updated_at":"2026-03-23T14:08:20.100566+00:00","description":"\nA flaw was found in the FTP GVfs backend. A malicious FTP server can\nexploit this vulnerability by providing an arbitrary IP address and port in\nits passive mode (PASV) response. The client unconditionally trusts this\ninformation and attempts to connect to the specified endpoint, allowing the\nmalicious server to probe for open ports accessible from the client's\nnetwork.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":4.3,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-28295","https://access.redhat.com/security/cve/CVE-2026-28295","https://ubuntu.com/security/notices/USN-8114-1"],"bugs":["https://gitlab.gnome.org/GNOME/gvfs/-/issues/832","https://bugzilla.redhat.com/show_bug.cgi?id=2443004"],"patches":{"gvfs":["upstream: https://gitlab.gnome.org/GNOME/gvfs/-/commit/20db8173252ea88a4af05dc9a24aad6f29b807ad","upstream: https://gitlab.gnome.org/GNOME/gvfs/-/commit/30f50ce256c2fb66828373973c4fd1542088de72","upstream: https://gitlab.gnome.org/GNOME/gvfs/-/commit/30b89fc61ef620dfa81492f68a21ee1fdb7021f3"]},"tags":{},"packages":[{"name":"gvfs","source":"https://ubuntu.com/security/cve?package=gvfs","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=gvfs","debian":"https://tracker.debian.org/pkg/gvfs","statuses":[{"release_codename":"resolute","status":"not-affected","description":"1.59.90-3","component":null,"pocket":"security"},{"release_codename":"noble","status":"released","description":"1.54.4-0ubuntu1~24.04.2","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.59.90-1","component":null,"pocket":"security"},{"release_codename":"jammy","status":"released","description":"1.48.2-0ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"questing","status":"released","description":"1.57.2-2ubuntu5.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-8114-1"],"notices":[{"id":"USN-8114-1","title":"GVfs vulnerabilities","summary":"Several security issues were fixed in GVfs.","instructions":"After a standard system update you need to restart your session to make\nall the necessary changes.","references":[],"published":"2026-03-23T12:53:19.912255","description":"It was discovered that the GVfs FTP backend incorrectly handled IP\naddresses and ports returned by passive mode responses. A malicious remote\nserver could possibly use this issue to help scan for open ports.\n(CVE-2026-28295)\n\nIt was discovered that the GVfs FTP backend incorrectly handled crafted\nfile paths. A remote attacker could use this issue to terminate or inject\narbitrary FTP commands, or possibly execute arbitrary code.\n(CVE-2026-28296)","is_hidden":false,"release_packages":{"jammy":[{"name":"gvfs","version":"1.48.2-0ubuntu1.1","description":"Userspace virtual file system","is_source":true},{"name":"gvfs","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-backends","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-common","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-daemons","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-fuse","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"},{"name":"gvfs-libs","version":"1.48.2-0ubuntu1.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.1","pocket":"security"}],"noble":[{"name":"gvfs","version":"1.54.4-0ubuntu1~24.04.2","description":"Userspace virtual file system","is_source":true},{"name":"gvfs","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-backends","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-common","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-daemons","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-fuse","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"},{"name":"gvfs-libs","version":"1.54.4-0ubuntu1~24.04.2","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2","pocket":"security"}],"questing":[{"name":"gvfs","version":"1.57.2-2ubuntu5.1","description":"Userspace virtual file system","is_source":true},{"name":"gvfs","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-backends","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-common","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-daemons","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-fuse","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"},{"name":"gvfs-libs","version":"1.57.2-2ubuntu5.1","is_source":false,"is_visible":false,"source_link":"https://launchpad.net/ubuntu/+source/gvfs","version_link":"https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1","pocket":"security"}]},"type":"USN","cves_ids":["CVE-2026-28296","CVE-2026-28295"]}]},{"id":"CVE-2025-64999","published":"2026-02-26T11:16:00","updated_at":"2026-08-17T19:09:43.873948+00:00","description":"\nImproper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22,\nand 2.3.0 before 2.3.0p43 allows an attacker that can manipulate a host's\ncheck output to inject malicious JavaScript into the Synthetic Monitoring\nHTML logs, which can then be accessed via a crafted phishing link.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":5.4,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},"baseScore":7.3,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2025-64999","https://checkmk.com/werk/19238"],"bugs":[""],"patches":{"check-mk":[]},"tags":{},"packages":[{"name":"check-mk","source":"https://ubuntu.com/security/cve?package=check-mk","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=check-mk","debian":"https://tracker.debian.org/pkg/check-mk","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-27970","published":"2026-02-26T02:16:00","updated_at":"2026-09-11T06:59:25.946859+00:00","description":"\nAngular is a development platform for building mobile and desktop web\napplications using TypeScript/JavaScript and other languages. Versions\nprior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting\nvulnerability in the Angular internationalization (i18n) pipeline. In ICU\nmessages (International Components for Unicode), HTML from translated\ncontent was not properly sanitized and could execute arbitrary JavaScript.\nAngular i18n typically involves three steps, extracting all messages from\nan application in the source language, sending the messages to be\ntranslated, and then merging their translations back into the final source\ncode. Translations are frequently handled by contracts with specific\npartner companies, and involve sending the source messages to a separate\ncontractor before receiving final translations for display to the end user.\nIf the returned translations have malicious content, it could be rendered\ninto the application and execute arbitrary JavaScript. When successfully\nexploited, this vulnerability allows for execution of attacker controlled\nJavaScript in the application origin. Depending on the nature of the\napplication being exploited this could lead to credential exfiltration\nand/or page vandalism. Several preconditions apply to the attack. The\nattacker must compromise the translation file (xliff, xtb, etc.). Unlike\nmost XSS vulnerabilities, this issue is not exploitable by arbitrary users.\nAn attacker must first compromise an application's translation file before\nthey can escalate privileges into the Angular application client. The\nvictim application must use Angular i18n, use one or more ICU messages,\nrender an ICU message, and not defend against XSS via a safe content\nsecurity policy. Versions 21.2.0, 21.1.6, 20.3.17, and 19.2.19 patch the\nissue. Until the patch is applied, developers should consider reviewing and\nverifying translated content received from untrusted third parties before\nincorporating it in an Angular application, enabling strict CSP controls to\nblock unauthorized JavaScript from executing on the page, and enabling\nTrusted Types to enforce proper HTML sanitization.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.1,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":7.6,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-27970","https://github.com/angular/angular/security/advisories/GHSA-prjf-86w9-mfqv"],"bugs":[""],"patches":{"angular.js":[]},"tags":{},"packages":[{"name":"angular.js","source":"https://ubuntu.com/security/cve?package=angular.js","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=angular.js","debian":"https://tracker.debian.org/pkg/angular.js","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-27942","published":"2026-02-26T02:16:00","updated_at":"2026-07-10T19:49:57.952188+00:00","description":"\nfast-xml-parser allows users to validate XML, parse XML to JS object, or\nbuild XML from JS object without C/C++ based libraries and no callback.\nPrior to version 5.3.8, the application crashes with stack overflow when\nuser use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the\nissue. As a workaround, use XML builder with `preserveOrder:false` or check\nthe input data before passing to builder.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}},"baseMetricV4":{"cvssV4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","baseMetrics":{"exploitabilityMetrics":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"},"vulnerableSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"subsequentSystemImpactMetrics":{"confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"NONE"}},"baseScore":2.7,"baseSeverity":"LOW"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-27942","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3","https://github.com/NaturalIntelligence/fast-xml-parser/pull/791","https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a"],"bugs":[""],"patches":{"node-webfont":[]},"tags":{},"packages":[{"name":"node-webfont","source":"https://ubuntu.com/security/cve?package=node-webfont","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-webfont","debian":"https://tracker.debian.org/pkg/node-webfont","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-27904","published":"2026-02-26T00:00:00","updated_at":"2026-02-27T14:42:44.798376+00:00","description":"\nminimatch is a minimal matching utility for converting glob expressions\ninto JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6,\n7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce\nregexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which\nexhibit catastrophic backtracking in V8. With a 12-byte pattern\n`*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for\nover 7 seconds. Adding a single nesting level or a few input characters\npushes this to minutes. This is the most severe finding: it is triggered by\nthe default `minimatch()` API with no special options, and the minimum\nviable pattern is only 12 bytes. The same issue affects `+()` extglobs\nequally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and\n3.1.4 fix the issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-27904","https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"bugs":[""],"patches":{"node-minimatch":[]},"tags":{},"packages":[{"name":"node-minimatch","source":"https://ubuntu.com/security/cve?package=node-minimatch","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-minimatch","debian":"https://tracker.debian.org/pkg/node-minimatch","statuses":[{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2026-27903","published":"2026-02-26T00:00:00","updated_at":"2026-02-27T14:40:47.715851+00:00","description":"\nminimatch is a minimal matching utility for converting glob expressions\ninto JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6,\n7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded\nrecursive backtracking when a glob pattern contains multiple non-adjacent\n`**` (GLOBSTAR) segments and the input path does not match. The time\ncomplexity is O(C(n, k)) -- binomial -- where `n` is the number of path\nsegments and `k` is the number of globstars. With k=11 and n=30, a call to\nthe default `minimatch()` API stalls for roughly 5 seconds. With k=13, it\nexceeds 15 seconds. No memoization or call budget exists to bound this\nbehavior. Any application where an attacker can influence the glob pattern\npassed to `minimatch()` is vulnerable. The realistic attack surface\nincludes build tools and task runners that accept user-supplied glob\narguments (ESLint, Webpack, Rollup config), multi-tenant systems where one\ntenant configures glob-based rules that run in a shared process, admin or\ndeveloper interfaces that accept ignore-rule or filter configuration as\nglobs, and CI/CD pipelines that evaluate user-submitted config files\ncontaining glob patterns. An attacker who can place a crafted pattern into\nany of these paths can stall the Node.js event loop for tens of seconds per\ninvocation. The pattern is 56 bytes for a 5-second stall and does not\nrequire authentication in contexts where pattern input is part of the\nfeature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and\n3.1.3 fix the issue.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2026-27903","https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"bugs":[""],"patches":{"node-minimatch":[]},"tags":{},"packages":[{"name":"node-minimatch","source":"https://ubuntu.com/security/cve?package=node-minimatch","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=node-minimatch","debian":"https://tracker.debian.org/pkg/node-minimatch","statuses":[{"release_codename":"questing","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"xenial","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"resolute","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"trusty","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"bionic","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"focal","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"jammy","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"noble","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":15020,"limit":20,"total_results":79316}