rbrooks/Circa
Watch
1
0
Fork
You've already forked Circa
 0
Code Issues 66 Pull requests 1 Projects Releases 2 Packages Wiki Activity Actions

🔒 Automated security scan findings #146

New issue
Open
opened 2026-08-06 07:10:45 +00:00 by renovate-bot · 0 comments
renovate-bot commented 2026-08-06 07:10:45 +00:00
Contributor
Copy link

Automated security scan

Filed by the fleet security scanner (.forgejo/workflows/security-scan.yml). Re-runs update this issue.

🔑 Secrets (1)

Secret values are redacted — inspect the commit locally.

Rule File Line Commit Date
generic-api-key backend/app/services/ingest.py 825 e50af5de31 2026-08-05

📦 git.rhoving.com/rbrooks/circa-frontend:latest (41 CVEs)

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL brotli-libs 1.2.0-r0 1.2.1-r0
CVE-2026-103111 HIGH pcre2 10.47-r0 10.49-r0
CVE-2026-107891 HIGH musl 1.2.5-r23 1.2.5-r24
CVE-2026-113351 HIGH libexpat 2.7.5-r0 2.10.0-r0
CVE-2026-11352 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-115506 HIGH libexpat 2.7.5-r0 2.10.0-r0
CVE-2026-11586 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-117610 HIGH libexpat 2.7.5-r0 2.10.0-r0
CVE-2026-118370 HIGH libexpat 2.7.5-r0 2.10.0-r0
CVE-2026-12064 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-14456 HIGH libcrypto3 3.5.6-r0 3.5.8-r0
CVE-2026-27135 HIGH nghttp2-libs 1.68.0-r0 1.68.1
CVE-2026-33630 HIGH c-ares 1.34.6-r0 1.34.8-r0
CVE-2026-45186 HIGH libexpat 2.7.5-r0 2.8.1-r0
CVE-2026-45447 HIGH libcrypto3 3.5.6-r0 3.5.7-r0
CVE-2026-4775 HIGH tiff 4.7.1-r0 4.7.2-r0
CVE-2026-53612 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-53613 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-53614 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-5773 HIGH curl 8.17.0-r1 8.20.0-r0
CVE-2026-6276 HIGH curl 8.17.0-r1 8.20.0-r0
CVE-2026-66046 HIGH libexpat 2.7.5-r0 2.8.4-r0
CVE-2026-6732 HIGH libxml2 2.13.9-r0 2.13.9-r1
CVE-2026-76641 HIGH libexpat 2.7.5-r0 2.8.4-r0
CVE-2026-76642 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-76956 HIGH libexpat 2.7.5-r0 2.8.4-r0
CVE-2026-76957 HIGH libexpat 2.7.5-r0 2.8.4-r0
CVE-2026-77214 HIGH libexpat 2.7.5-r0 2.9.0-r0
CVE-2026-78408 HIGH libuuid 2.41.4-r0 2.41.6-r1
CVE-2026-78410 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-8286 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-8458 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-85091 HIGH zlib 1.3.2-r0 1.3.2-r1
CVE-2026-86145 HIGH pcre2 10.47-r0 10.48-r0
CVE-2026-89157 HIGH pcre2 10.47-r0 10.48-r0
CVE-2026-89161 HIGH pcre2 10.47-r0 10.48-r0
CVE-2026-8925 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-8927 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-92392 HIGH curl 8.17.0-r1 8.23.0-r0
CVE-2026-93990 HIGH libexpat 2.7.5-r0 2.8.5-r0
CVE-2026-9547 HIGH curl 8.17.0-r1 8.22.0-r0

📦 git.rhoving.com/rbrooks/circa-backend:latest (74 CVEs)

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL libbrotli1 1.1.0-2+b7 1.1.0-2+deb13u1
CVE-2026-112393 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-112398 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-112403 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-112900 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-13221 CRITICAL perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-42496 CRITICAL perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-58016 CRITICAL libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-8376 CRITICAL perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-96639 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-96760 CRITICAL Authlib 1.7.2 1.9.0
GHSA-6q48-6c7w-9gw2 CRITICAL certifi 2026.7.22 2026.10.18
CVE-2026-103111 HIGH libpcre2-8-0 10.46-1~deb13u1 10.46-1~deb13u3
CVE-2026-109518 HIGH apt 3.0.3 3.0.4
CVE-2026-112390 HIGH pillow 12.3.0 13.0.0
CVE-2026-112392 HIGH pillow 12.3.0 13.0.0
CVE-2026-112397 HIGH pillow 12.3.0 13.0.0
CVE-2026-112399 HIGH pillow 12.3.0 13.0.0
CVE-2026-112400 HIGH pillow 12.3.0 13.0.0
CVE-2026-112402 HIGH pillow 12.3.0 13.0.0
CVE-2026-112404 HIGH pillow 12.3.0 13.0.0
CVE-2026-112405 HIGH pillow 12.3.0 13.0.0
CVE-2026-112406 HIGH pillow 12.3.0 13.0.0
CVE-2026-112892 HIGH pillow 12.3.0 13.0.0
CVE-2026-112893 HIGH pillow 12.3.0 13.0.0
CVE-2026-112894 HIGH pillow 12.3.0 13.0.0
CVE-2026-112895 HIGH pillow 12.3.0 13.0.0
CVE-2026-112896 HIGH pillow 12.3.0 13.0.0
CVE-2026-112897 HIGH pillow 12.3.0 13.0.0
CVE-2026-112902 HIGH pillow 12.3.0 13.0.0
CVE-2026-114615 HIGH Authlib 1.7.2 1.9.0
CVE-2026-114616 HIGH Authlib 1.7.2 1.9.1
CVE-2026-116672 HIGH Authlib 1.7.2 1.9.1
CVE-2026-11822 HIGH libsqlite3-0 3.46.1-7+deb13u1 3.46.1-7+deb13u2
CVE-2026-11824 HIGH libsqlite3-0 3.46.1-7+deb13u1 3.46.1-7+deb13u2
CVE-2026-119283 HIGH joserfc 1.7.4 1.7.5
CVE-2026-14456 HIGH libssl3t64 3.5.6-1~deb13u2 3.5.7-1~deb13u2
CVE-2026-41992 HIGH gzip 1.13-1 1.13-1+deb13u1
CVE-2026-42497 HIGH perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-48962 HIGH perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-53612 HIGH bsdutils 1:2.41-5 2.41.5-0+deb13u1
CVE-2026-53613 HIGH bsdutils 1:2.41-5 2.41.5-0+deb13u1
CVE-2026-53614 HIGH bsdutils 1:2.41-5 2.41.5-0+deb13u1
CVE-2026-53615 HIGH bsdutils 1:2.41-5 2.41.5-0+deb13u1
CVE-2026-57432 HIGH perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-57433 HIGH perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-58010 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58011 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58012 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58013 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58014 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58015 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58050 HIGH libssh2-1t64 1.11.1-1+deb13u1 1.11.1-1+deb13u2
CVE-2026-66046 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-76844 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-76956 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-76957 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-77214 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-8286 HIGH libcurl4t64 8.14.1-2+deb13u4 8.14.1-2+deb13u7
CVE-2026-84782 HIGH libssl3t64 3.5.6-1~deb13u2 3.5.7-1~deb13u3
CVE-2026-85091 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-86145 HIGH libpcre2-8-0 10.46-1~deb13u1 10.46-1~deb13u2
CVE-2026-89157 HIGH libpcre2-8-0 10.46-1~deb13u1 10.46-1~deb13u2
CVE-2026-89161 HIGH libpcre2-8-0 10.46-1~deb13u1 10.46-1~deb13u2
CVE-2026-8927 HIGH libcurl4t64 8.14.1-2+deb13u4 8.14.1-2+deb13u7
CVE-2026-92392 HIGH libcurl4t64 8.14.1-2+deb13u4 8.14.1-2+deb13u7
CVE-2026-93990 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-96637 HIGH pillow 12.3.0 13.0.0
CVE-2026-96640 HIGH pillow 12.3.0 13.0.0
CVE-2026-96642 HIGH pillow 12.3.0 13.0.0
CVE-2026-96643 HIGH pillow 12.3.0 13.0.0
CVE-2026-96644 HIGH pillow 12.3.0 13.0.0
CVE-2026-96778 HIGH pillow 12.3.0 13.0.0
GHSA-78g4-xqwv-q3g8 HIGH pillow 12.3.0 13.0.0

📦 git.rhoving.com/rbrooks/circa-backend:0.3.3 (74 CVEs)

Production-pinned — circa_backend_image in inventory/group_vars/circa/vars.yml.

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL libbrotli1 1.1.0-2+b7 1.1.0-2+deb13u1
CVE-2026-112393 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-112398 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-112403 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-112900 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-13221 CRITICAL perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-42496 CRITICAL perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-58016 CRITICAL libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-8376 CRITICAL perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-96639 CRITICAL pillow 12.3.0 13.0.0
CVE-2026-96760 CRITICAL Authlib 1.7.2 1.9.0
GHSA-6q48-6c7w-9gw2 CRITICAL certifi 2026.7.22 2026.10.18
CVE-2026-103111 HIGH libpcre2-8-0 10.46-1~deb13u1 10.46-1~deb13u3
CVE-2026-109518 HIGH apt 3.0.3 3.0.4
CVE-2026-112390 HIGH pillow 12.3.0 13.0.0
CVE-2026-112392 HIGH pillow 12.3.0 13.0.0
CVE-2026-112397 HIGH pillow 12.3.0 13.0.0
CVE-2026-112399 HIGH pillow 12.3.0 13.0.0
CVE-2026-112400 HIGH pillow 12.3.0 13.0.0
CVE-2026-112402 HIGH pillow 12.3.0 13.0.0
CVE-2026-112404 HIGH pillow 12.3.0 13.0.0
CVE-2026-112405 HIGH pillow 12.3.0 13.0.0
CVE-2026-112406 HIGH pillow 12.3.0 13.0.0
CVE-2026-112892 HIGH pillow 12.3.0 13.0.0
CVE-2026-112893 HIGH pillow 12.3.0 13.0.0
CVE-2026-112894 HIGH pillow 12.3.0 13.0.0
CVE-2026-112895 HIGH pillow 12.3.0 13.0.0
CVE-2026-112896 HIGH pillow 12.3.0 13.0.0
CVE-2026-112897 HIGH pillow 12.3.0 13.0.0
CVE-2026-112902 HIGH pillow 12.3.0 13.0.0
CVE-2026-114615 HIGH Authlib 1.7.2 1.9.0
CVE-2026-114616 HIGH Authlib 1.7.2 1.9.1
CVE-2026-116672 HIGH Authlib 1.7.2 1.9.1
CVE-2026-11822 HIGH libsqlite3-0 3.46.1-7+deb13u1 3.46.1-7+deb13u2
CVE-2026-11824 HIGH libsqlite3-0 3.46.1-7+deb13u1 3.46.1-7+deb13u2
CVE-2026-119283 HIGH joserfc 1.7.4 1.7.5
CVE-2026-14456 HIGH libssl3t64 3.5.6-1~deb13u2 3.5.7-1~deb13u2
CVE-2026-41992 HIGH gzip 1.13-1 1.13-1+deb13u1
CVE-2026-42497 HIGH perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-48962 HIGH perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-53612 HIGH bsdutils 1:2.41-5 2.41.5-0+deb13u1
CVE-2026-53613 HIGH bsdutils 1:2.41-5 2.41.5-0+deb13u1
CVE-2026-53614 HIGH bsdutils 1:2.41-5 2.41.5-0+deb13u1
CVE-2026-53615 HIGH bsdutils 1:2.41-5 2.41.5-0+deb13u1
CVE-2026-57432 HIGH perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-57433 HIGH perl-base 5.40.1-6 5.40.1-6+deb13u1
CVE-2026-58010 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58011 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58012 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58013 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58014 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58015 HIGH libglib2.0-0t64 2.84.4-3~deb13u3 2.84.4-3~deb13u4
CVE-2026-58050 HIGH libssh2-1t64 1.11.1-1+deb13u1 1.11.1-1+deb13u2
CVE-2026-66046 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-76844 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-76956 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-76957 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-77214 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-8286 HIGH libcurl4t64 8.14.1-2+deb13u4 8.14.1-2+deb13u7
CVE-2026-84782 HIGH libssl3t64 3.5.6-1~deb13u2 3.5.7-1~deb13u3
CVE-2026-85091 HIGH zlib1g 1:1.3.dfsg+really1.3.1-1+b1 1:1.3.dfsg+really1.3.1-1+deb13u1
CVE-2026-86145 HIGH libpcre2-8-0 10.46-1~deb13u1 10.46-1~deb13u2
CVE-2026-89157 HIGH libpcre2-8-0 10.46-1~deb13u1 10.46-1~deb13u2
CVE-2026-89161 HIGH libpcre2-8-0 10.46-1~deb13u1 10.46-1~deb13u2
CVE-2026-8927 HIGH libcurl4t64 8.14.1-2+deb13u4 8.14.1-2+deb13u7
CVE-2026-92392 HIGH libcurl4t64 8.14.1-2+deb13u4 8.14.1-2+deb13u7
CVE-2026-93990 HIGH libexpat1 2.8.2-1~deb13u1 2.9.0-1~deb13u1
CVE-2026-96637 HIGH pillow 12.3.0 13.0.0
CVE-2026-96640 HIGH pillow 12.3.0 13.0.0
CVE-2026-96642 HIGH pillow 12.3.0 13.0.0
CVE-2026-96643 HIGH pillow 12.3.0 13.0.0
CVE-2026-96644 HIGH pillow 12.3.0 13.0.0
CVE-2026-96778 HIGH pillow 12.3.0 13.0.0
GHSA-78g4-xqwv-q3g8 HIGH pillow 12.3.0 13.0.0

📦 git.rhoving.com/rbrooks/circa-frontend:0.3.3 (41 CVEs)

Production-pinned — circa_frontend_image in inventory/group_vars/circa/vars.yml.

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL brotli-libs 1.2.0-r0 1.2.1-r0
CVE-2026-103111 HIGH pcre2 10.47-r0 10.49-r0
CVE-2026-107891 HIGH musl 1.2.5-r23 1.2.5-r24
CVE-2026-113351 HIGH libexpat 2.7.5-r0 2.10.0-r0
CVE-2026-11352 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-115506 HIGH libexpat 2.7.5-r0 2.10.0-r0
CVE-2026-11586 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-117610 HIGH libexpat 2.7.5-r0 2.10.0-r0
CVE-2026-118370 HIGH libexpat 2.7.5-r0 2.10.0-r0
CVE-2026-12064 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-14456 HIGH libcrypto3 3.5.6-r0 3.5.8-r0
CVE-2026-27135 HIGH nghttp2-libs 1.68.0-r0 1.68.1
CVE-2026-33630 HIGH c-ares 1.34.6-r0 1.34.8-r0
CVE-2026-45186 HIGH libexpat 2.7.5-r0 2.8.1-r0
CVE-2026-45447 HIGH libcrypto3 3.5.6-r0 3.5.7-r0
CVE-2026-4775 HIGH tiff 4.7.1-r0 4.7.2-r0
CVE-2026-53612 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-53613 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-53614 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-5773 HIGH curl 8.17.0-r1 8.20.0-r0
CVE-2026-6276 HIGH curl 8.17.0-r1 8.20.0-r0
CVE-2026-66046 HIGH libexpat 2.7.5-r0 2.8.4-r0
CVE-2026-6732 HIGH libxml2 2.13.9-r0 2.13.9-r1
CVE-2026-76641 HIGH libexpat 2.7.5-r0 2.8.4-r0
CVE-2026-76642 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-76956 HIGH libexpat 2.7.5-r0 2.8.4-r0
CVE-2026-76957 HIGH libexpat 2.7.5-r0 2.8.4-r0
CVE-2026-77214 HIGH libexpat 2.7.5-r0 2.9.0-r0
CVE-2026-78408 HIGH libuuid 2.41.4-r0 2.41.6-r1
CVE-2026-78410 HIGH libuuid 2.41.4-r0 2.41.6-r0
CVE-2026-8286 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-8458 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-85091 HIGH zlib 1.3.2-r0 1.3.2-r1
CVE-2026-86145 HIGH pcre2 10.47-r0 10.48-r0
CVE-2026-89157 HIGH pcre2 10.47-r0 10.48-r0
CVE-2026-89161 HIGH pcre2 10.47-r0 10.48-r0
CVE-2026-8925 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-8927 HIGH curl 8.17.0-r1 8.22.0-r0
CVE-2026-92392 HIGH curl 8.17.0-r1 8.23.0-r0
CVE-2026-93990 HIGH libexpat 2.7.5-r0 2.8.5-r0
CVE-2026-9547 HIGH curl 8.17.0-r1 8.22.0-r0
<!-- fleet-security-scan --> ## Automated security scan Filed by the fleet security scanner (`.forgejo/workflows/security-scan.yml`). Re-runs update this issue. ### 🔑 Secrets (1) Secret values are redacted — inspect the commit locally. | Rule | File | Line | Commit | Date | |------|------|------|--------|------| | `generic-api-key` | `backend/app/services/ingest.py` | 825 | `e50af5de31` | 2026-08-05 | ### 📦 `git.rhoving.com/rbrooks/circa-frontend:latest` (41 CVEs) | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `brotli-libs` | 1.2.0-r0 | 1.2.1-r0 | | CVE-2026-103111 | HIGH | `pcre2` | 10.47-r0 | 10.49-r0 | | CVE-2026-107891 | HIGH | `musl` | 1.2.5-r23 | 1.2.5-r24 | | CVE-2026-113351 | HIGH | `libexpat` | 2.7.5-r0 | 2.10.0-r0 | | CVE-2026-11352 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-115506 | HIGH | `libexpat` | 2.7.5-r0 | 2.10.0-r0 | | CVE-2026-11586 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-117610 | HIGH | `libexpat` | 2.7.5-r0 | 2.10.0-r0 | | CVE-2026-118370 | HIGH | `libexpat` | 2.7.5-r0 | 2.10.0-r0 | | CVE-2026-12064 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-14456 | HIGH | `libcrypto3` | 3.5.6-r0 | 3.5.8-r0 | | CVE-2026-27135 | HIGH | `nghttp2-libs` | 1.68.0-r0 | 1.68.1 | | CVE-2026-33630 | HIGH | `c-ares` | 1.34.6-r0 | 1.34.8-r0 | | CVE-2026-45186 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.1-r0 | | CVE-2026-45447 | HIGH | `libcrypto3` | 3.5.6-r0 | 3.5.7-r0 | | CVE-2026-4775 | HIGH | `tiff` | 4.7.1-r0 | 4.7.2-r0 | | CVE-2026-53612 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-53613 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-53614 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-5773 | HIGH | `curl` | 8.17.0-r1 | 8.20.0-r0 | | CVE-2026-6276 | HIGH | `curl` | 8.17.0-r1 | 8.20.0-r0 | | CVE-2026-66046 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.4-r0 | | CVE-2026-6732 | HIGH | `libxml2` | 2.13.9-r0 | 2.13.9-r1 | | CVE-2026-76641 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.4-r0 | | CVE-2026-76642 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-76956 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.4-r0 | | CVE-2026-76957 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.4-r0 | | CVE-2026-77214 | HIGH | `libexpat` | 2.7.5-r0 | 2.9.0-r0 | | CVE-2026-78408 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r1 | | CVE-2026-78410 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-8286 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-8458 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-85091 | HIGH | `zlib` | 1.3.2-r0 | 1.3.2-r1 | | CVE-2026-86145 | HIGH | `pcre2` | 10.47-r0 | 10.48-r0 | | CVE-2026-89157 | HIGH | `pcre2` | 10.47-r0 | 10.48-r0 | | CVE-2026-89161 | HIGH | `pcre2` | 10.47-r0 | 10.48-r0 | | CVE-2026-8925 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-8927 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-92392 | HIGH | `curl` | 8.17.0-r1 | 8.23.0-r0 | | CVE-2026-93990 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.5-r0 | | CVE-2026-9547 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | ### 📦 `git.rhoving.com/rbrooks/circa-backend:latest` (74 CVEs) | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `libbrotli1` | 1.1.0-2+b7 | 1.1.0-2+deb13u1 | | CVE-2026-112393 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112398 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112403 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112900 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-13221 | CRITICAL | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-42496 | CRITICAL | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-58016 | CRITICAL | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-8376 | CRITICAL | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-96639 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96760 | CRITICAL | `Authlib` | 1.7.2 | 1.9.0 | | GHSA-6q48-6c7w-9gw2 | CRITICAL | `certifi` | 2026.7.22 | 2026.10.18 | | CVE-2026-103111 | HIGH | `libpcre2-8-0` | 10.46-1~deb13u1 | 10.46-1~deb13u3 | | CVE-2026-109518 | HIGH | `apt` | 3.0.3 | 3.0.4 | | CVE-2026-112390 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112392 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112397 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112399 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112400 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112402 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112404 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112405 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112406 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112892 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112893 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112894 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112895 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112896 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112897 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112902 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-114615 | HIGH | `Authlib` | 1.7.2 | 1.9.0 | | CVE-2026-114616 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-116672 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-11822 | HIGH | `libsqlite3-0` | 3.46.1-7+deb13u1 | 3.46.1-7+deb13u2 | | CVE-2026-11824 | HIGH | `libsqlite3-0` | 3.46.1-7+deb13u1 | 3.46.1-7+deb13u2 | | CVE-2026-119283 | HIGH | `joserfc` | 1.7.4 | 1.7.5 | | CVE-2026-14456 | HIGH | `libssl3t64` | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | | CVE-2026-41992 | HIGH | `gzip` | 1.13-1 | 1.13-1+deb13u1 | | CVE-2026-42497 | HIGH | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-48962 | HIGH | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-53612 | HIGH | `bsdutils` | 1:2.41-5 | 2.41.5-0+deb13u1 | | CVE-2026-53613 | HIGH | `bsdutils` | 1:2.41-5 | 2.41.5-0+deb13u1 | | CVE-2026-53614 | HIGH | `bsdutils` | 1:2.41-5 | 2.41.5-0+deb13u1 | | CVE-2026-53615 | HIGH | `bsdutils` | 1:2.41-5 | 2.41.5-0+deb13u1 | | CVE-2026-57432 | HIGH | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-57433 | HIGH | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-58010 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58011 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58012 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58013 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58014 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58015 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58050 | HIGH | `libssh2-1t64` | 1.11.1-1+deb13u1 | 1.11.1-1+deb13u2 | | CVE-2026-66046 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-76844 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-76956 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-76957 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-77214 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-8286 | HIGH | `libcurl4t64` | 8.14.1-2+deb13u4 | 8.14.1-2+deb13u7 | | CVE-2026-84782 | HIGH | `libssl3t64` | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u3 | | CVE-2026-85091 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-86145 | HIGH | `libpcre2-8-0` | 10.46-1~deb13u1 | 10.46-1~deb13u2 | | CVE-2026-89157 | HIGH | `libpcre2-8-0` | 10.46-1~deb13u1 | 10.46-1~deb13u2 | | CVE-2026-89161 | HIGH | `libpcre2-8-0` | 10.46-1~deb13u1 | 10.46-1~deb13u2 | | CVE-2026-8927 | HIGH | `libcurl4t64` | 8.14.1-2+deb13u4 | 8.14.1-2+deb13u7 | | CVE-2026-92392 | HIGH | `libcurl4t64` | 8.14.1-2+deb13u4 | 8.14.1-2+deb13u7 | | CVE-2026-93990 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-96637 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96640 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96642 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96643 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96644 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96778 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | GHSA-78g4-xqwv-q3g8 | HIGH | `pillow` | 12.3.0 | 13.0.0 | ### 📦 `git.rhoving.com/rbrooks/circa-backend:0.3.3` (74 CVEs) **Production-pinned** — `circa_backend_image` in `inventory/group_vars/circa/vars.yml`. | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `libbrotli1` | 1.1.0-2+b7 | 1.1.0-2+deb13u1 | | CVE-2026-112393 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112398 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112403 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112900 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-13221 | CRITICAL | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-42496 | CRITICAL | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-58016 | CRITICAL | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-8376 | CRITICAL | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-96639 | CRITICAL | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96760 | CRITICAL | `Authlib` | 1.7.2 | 1.9.0 | | GHSA-6q48-6c7w-9gw2 | CRITICAL | `certifi` | 2026.7.22 | 2026.10.18 | | CVE-2026-103111 | HIGH | `libpcre2-8-0` | 10.46-1~deb13u1 | 10.46-1~deb13u3 | | CVE-2026-109518 | HIGH | `apt` | 3.0.3 | 3.0.4 | | CVE-2026-112390 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112392 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112397 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112399 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112400 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112402 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112404 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112405 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112406 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112892 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112893 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112894 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112895 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112896 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112897 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-112902 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-114615 | HIGH | `Authlib` | 1.7.2 | 1.9.0 | | CVE-2026-114616 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-116672 | HIGH | `Authlib` | 1.7.2 | 1.9.1 | | CVE-2026-11822 | HIGH | `libsqlite3-0` | 3.46.1-7+deb13u1 | 3.46.1-7+deb13u2 | | CVE-2026-11824 | HIGH | `libsqlite3-0` | 3.46.1-7+deb13u1 | 3.46.1-7+deb13u2 | | CVE-2026-119283 | HIGH | `joserfc` | 1.7.4 | 1.7.5 | | CVE-2026-14456 | HIGH | `libssl3t64` | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | | CVE-2026-41992 | HIGH | `gzip` | 1.13-1 | 1.13-1+deb13u1 | | CVE-2026-42497 | HIGH | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-48962 | HIGH | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-53612 | HIGH | `bsdutils` | 1:2.41-5 | 2.41.5-0+deb13u1 | | CVE-2026-53613 | HIGH | `bsdutils` | 1:2.41-5 | 2.41.5-0+deb13u1 | | CVE-2026-53614 | HIGH | `bsdutils` | 1:2.41-5 | 2.41.5-0+deb13u1 | | CVE-2026-53615 | HIGH | `bsdutils` | 1:2.41-5 | 2.41.5-0+deb13u1 | | CVE-2026-57432 | HIGH | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-57433 | HIGH | `perl-base` | 5.40.1-6 | 5.40.1-6+deb13u1 | | CVE-2026-58010 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58011 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58012 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58013 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58014 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58015 | HIGH | `libglib2.0-0t64` | 2.84.4-3~deb13u3 | 2.84.4-3~deb13u4 | | CVE-2026-58050 | HIGH | `libssh2-1t64` | 1.11.1-1+deb13u1 | 1.11.1-1+deb13u2 | | CVE-2026-66046 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-76844 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-76956 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-76957 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-77214 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-8286 | HIGH | `libcurl4t64` | 8.14.1-2+deb13u4 | 8.14.1-2+deb13u7 | | CVE-2026-84782 | HIGH | `libssl3t64` | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u3 | | CVE-2026-85091 | HIGH | `zlib1g` | 1:1.3.dfsg+really1.3.1-1+b1 | 1:1.3.dfsg+really1.3.1-1+deb13u1 | | CVE-2026-86145 | HIGH | `libpcre2-8-0` | 10.46-1~deb13u1 | 10.46-1~deb13u2 | | CVE-2026-89157 | HIGH | `libpcre2-8-0` | 10.46-1~deb13u1 | 10.46-1~deb13u2 | | CVE-2026-89161 | HIGH | `libpcre2-8-0` | 10.46-1~deb13u1 | 10.46-1~deb13u2 | | CVE-2026-8927 | HIGH | `libcurl4t64` | 8.14.1-2+deb13u4 | 8.14.1-2+deb13u7 | | CVE-2026-92392 | HIGH | `libcurl4t64` | 8.14.1-2+deb13u4 | 8.14.1-2+deb13u7 | | CVE-2026-93990 | HIGH | `libexpat1` | 2.8.2-1~deb13u1 | 2.9.0-1~deb13u1 | | CVE-2026-96637 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96640 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96642 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96643 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96644 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | CVE-2026-96778 | HIGH | `pillow` | 12.3.0 | 13.0.0 | | GHSA-78g4-xqwv-q3g8 | HIGH | `pillow` | 12.3.0 | 13.0.0 | ### 📦 `git.rhoving.com/rbrooks/circa-frontend:0.3.3` (41 CVEs) **Production-pinned** — `circa_frontend_image` in `inventory/group_vars/circa/vars.yml`. | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `brotli-libs` | 1.2.0-r0 | 1.2.1-r0 | | CVE-2026-103111 | HIGH | `pcre2` | 10.47-r0 | 10.49-r0 | | CVE-2026-107891 | HIGH | `musl` | 1.2.5-r23 | 1.2.5-r24 | | CVE-2026-113351 | HIGH | `libexpat` | 2.7.5-r0 | 2.10.0-r0 | | CVE-2026-11352 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-115506 | HIGH | `libexpat` | 2.7.5-r0 | 2.10.0-r0 | | CVE-2026-11586 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-117610 | HIGH | `libexpat` | 2.7.5-r0 | 2.10.0-r0 | | CVE-2026-118370 | HIGH | `libexpat` | 2.7.5-r0 | 2.10.0-r0 | | CVE-2026-12064 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-14456 | HIGH | `libcrypto3` | 3.5.6-r0 | 3.5.8-r0 | | CVE-2026-27135 | HIGH | `nghttp2-libs` | 1.68.0-r0 | 1.68.1 | | CVE-2026-33630 | HIGH | `c-ares` | 1.34.6-r0 | 1.34.8-r0 | | CVE-2026-45186 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.1-r0 | | CVE-2026-45447 | HIGH | `libcrypto3` | 3.5.6-r0 | 3.5.7-r0 | | CVE-2026-4775 | HIGH | `tiff` | 4.7.1-r0 | 4.7.2-r0 | | CVE-2026-53612 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-53613 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-53614 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-5773 | HIGH | `curl` | 8.17.0-r1 | 8.20.0-r0 | | CVE-2026-6276 | HIGH | `curl` | 8.17.0-r1 | 8.20.0-r0 | | CVE-2026-66046 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.4-r0 | | CVE-2026-6732 | HIGH | `libxml2` | 2.13.9-r0 | 2.13.9-r1 | | CVE-2026-76641 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.4-r0 | | CVE-2026-76642 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-76956 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.4-r0 | | CVE-2026-76957 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.4-r0 | | CVE-2026-77214 | HIGH | `libexpat` | 2.7.5-r0 | 2.9.0-r0 | | CVE-2026-78408 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r1 | | CVE-2026-78410 | HIGH | `libuuid` | 2.41.4-r0 | 2.41.6-r0 | | CVE-2026-8286 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-8458 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-85091 | HIGH | `zlib` | 1.3.2-r0 | 1.3.2-r1 | | CVE-2026-86145 | HIGH | `pcre2` | 10.47-r0 | 10.48-r0 | | CVE-2026-89157 | HIGH | `pcre2` | 10.47-r0 | 10.48-r0 | | CVE-2026-89161 | HIGH | `pcre2` | 10.47-r0 | 10.48-r0 | | CVE-2026-8925 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-8927 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 | | CVE-2026-92392 | HIGH | `curl` | 8.17.0-r1 | 8.23.0-r0 | | CVE-2026-93990 | HIGH | `libexpat` | 2.7.5-r0 | 2.8.5-r0 | | CVE-2026-9547 | HIGH | `curl` | 8.17.0-r1 | 8.22.0-r0 |
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/lock-file-maintenance
v0.3.3
v0.3.2
v0.3.1
v0.3.0
v0.2.0
Labels
Clear labels   
ai
AI / OCR evidence backends

  
backend
Backend / API / services

  
bug
Something is not working

  
docs
Documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
frontend
React UI

  
help wanted
Need some help

  
infra
CI, deployment, tooling

  
invalid
Something is wrong

  
question
More information is needed

  
security
Auth, authorization, data safety

  
testing
Automated tests and QA

  
wontfix
This won't be fixed

  
worker
Background jobs and worker runtime

No labels
ai
backend
bug
docs
duplicate
enhancement
frontend
help wanted
infra
invalid
question
security
testing
wontfix
worker
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/Circa#146
No description provided.