rbrooks/TeaLeaves
Watch
1
0
Fork
You've already forked TeaLeaves
 0
Code Issues 15 Pull requests 2 Projects Releases 17 Packages Wiki Activity Actions

🔒 Automated security scan findings #182

New issue
Open
opened 2026-10-29 07:08:33 +00:00 by renovate-bot · 0 comments
renovate-bot commented 2026-10-29 07:08:33 +00:00
Contributor
Copy link

Automated security scan

Filed by the fleet security scanner (.forgejo/workflows/security-scan.yml). Re-runs update this issue.

📦 git.rhoving.com/rbrooks/tealeaves-app:latest (28 CVEs)

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL brotli-libs 1.2.0-r1 1.2.1-r0
CVE-2026-103111 HIGH pcre2 10.47-r1 10.49-r0
CVE-2026-107891 HIGH musl 1.2.6-r2 1.2.6-r3
CVE-2026-113351 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-115506 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-117610 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-118370 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-14456 HIGH libcrypto3 3.5.7-r0 3.5.8-r0
CVE-2026-4775 HIGH tiff 4.7.1-r0 4.7.2-r0
CVE-2026-53612 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-53613 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-53614 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-66046 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-76641 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-76642 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-76956 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-76957 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-77214 HIGH libexpat 2.8.2-r0 2.9.0-r0
CVE-2026-78408 HIGH libuuid 2.42.1-r0 2.42.3-r1
CVE-2026-78409 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-78410 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-85091 HIGH zlib 1.3.2-r0 1.3.2-r1
CVE-2026-86145 HIGH pcre2 10.47-r1 10.48-r0
CVE-2026-88806 HIGH libx11 1.8.13-r0 1.8.14-r0
CVE-2026-89157 HIGH pcre2 10.47-r1 10.48-r0
CVE-2026-89161 HIGH pcre2 10.47-r1 10.48-r0
CVE-2026-92392 HIGH curl 8.21.0-r0 8.23.0-r0
CVE-2026-93990 HIGH libexpat 2.8.2-r0 2.8.5-r0

📦 git.rhoving.com/rbrooks/tealeaves-app:stable (28 CVEs)

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL brotli-libs 1.2.0-r1 1.2.1-r0
CVE-2026-103111 HIGH pcre2 10.47-r1 10.49-r0
CVE-2026-107891 HIGH musl 1.2.6-r2 1.2.6-r3
CVE-2026-113351 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-115506 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-117610 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-118370 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-14456 HIGH libcrypto3 3.5.7-r0 3.5.8-r0
CVE-2026-4775 HIGH tiff 4.7.1-r0 4.7.2-r0
CVE-2026-53612 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-53613 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-53614 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-66046 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-76641 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-76642 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-76956 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-76957 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-77214 HIGH libexpat 2.8.2-r0 2.9.0-r0
CVE-2026-78408 HIGH libuuid 2.42.1-r0 2.42.3-r1
CVE-2026-78409 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-78410 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-85091 HIGH zlib 1.3.2-r0 1.3.2-r1
CVE-2026-86145 HIGH pcre2 10.47-r1 10.48-r0
CVE-2026-88806 HIGH libx11 1.8.13-r0 1.8.14-r0
CVE-2026-89157 HIGH pcre2 10.47-r1 10.48-r0
CVE-2026-89161 HIGH pcre2 10.47-r1 10.48-r0
CVE-2026-92392 HIGH curl 8.21.0-r0 8.23.0-r0
CVE-2026-93990 HIGH libexpat 2.8.2-r0 2.8.5-r0

📦 git.rhoving.com/rbrooks/tealeaves-api:beta (8 CVEs)

Production-pinned — tealeaves_api_image in inventory/host_vars/docker-test/vars.yml.

CVE Severity Package Installed Fixed
CVE-2026-102276 HIGH brace-expansion 5.0.9 5.0.10, 3.0.7, 2.1.5, 1.1.19
CVE-2026-102278 HIGH brace-expansion 5.0.9 5.0.11, 3.0.8, 2.1.6, 1.1.20
CVE-2026-109383 HIGH undici 6.28.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-109869 HIGH undici 6.28.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-19534 HIGH undici 6.28.0 6.28.1, 7.29.1, 8.10.2
CVE-2026-87018 HIGH undici 6.28.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-90776 HIGH nodemailer 9.1.1 10.0.5
GHSA-v53p-9fqp-m79j HIGH nodemailer 9.1.1 10.0.6

📦 git.rhoving.com/rbrooks/tealeaves-api:latest (64 CVEs)

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL libbrotli1 1.0.9-2+b6 1.0.9-2+deb12u1
CVE-2026-13221 CRITICAL libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-42496 CRITICAL libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-59873 CRITICAL tar 7.5.15 7.5.19
CVE-2026-8376 CRITICAL libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-90711 CRITICAL proxy-addr 2.0.7 2.0.8
CVE-2024-28757 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2025-59375 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u5
CVE-2026-0966 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-102276 HIGH brace-expansion 5.0.6 5.0.10, 3.0.7, 2.1.5, 1.1.19
CVE-2026-102278 HIGH brace-expansion 5.0.6 5.0.11, 3.0.8, 2.1.6, 1.1.20
CVE-2026-102282 HIGH adm-zip 0.5.18 0.6.1
CVE-2026-103111 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u2
CVE-2026-109383 HIGH undici 6.26.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-109518 HIGH apt 2.6.1 2.6.2
CVE-2026-109869 HIGH undici 6.26.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-111181 HIGH body-parser 2.3.0 2.4.0, 1.20.9
CVE-2026-113872 HIGH multer 2.2.0 2.5.0
CVE-2026-12151 HIGH undici 6.26.0 6.27.0, 7.28.0, 8.5.0
CVE-2026-13149 HIGH brace-expansion 5.0.6 5.0.7, 1.1.16, 2.1.2
CVE-2026-14257 HIGH brace-expansion 5.0.6 5.0.8, 3.0.3, 2.1.3, 1.1.17
CVE-2026-19534 HIGH undici 6.26.0 6.28.1, 7.29.1, 8.10.2
CVE-2026-25210 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-3731 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-39244 HIGH adm-zip 0.5.18 0.6.0
CVE-2026-42497 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-45186 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-48962 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-56208 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-56209 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-56210 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-56211 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-57432 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-57433 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-59847 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-59850 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-59874 HIGH tar 7.5.15 7.5.18
CVE-2026-61627 HIGH libass9 1:0.17.1-1 1:0.17.1-1+deb12u1
CVE-2026-66046 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-67213 HIGH nanoid 3.3.16 3.3.18, 5.1.6
CVE-2026-69152 HIGH brace-expansion 5.0.6 1.1.18, 2.1.4, 3.0.6, 5.0.9
CVE-2026-69192 HIGH ip-address 10.2.0 10.3.1
CVE-2026-73566 HIGH tar 7.5.15 7.5.21
CVE-2026-76957 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u3
CVE-2026-77037 HIGH multer 2.2.0 2.3.0
CVE-2026-77078 HIGH multer 2.2.0 2.3.0
CVE-2026-77214 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u5
CVE-2026-77301 HIGH adm-zip 0.5.18 0.6.1
CVE-2026-82333 HIGH multer 2.2.0 2.3.0
CVE-2026-84782 HIGH libssl3 3.0.20-1~deb12u2 3.0.22-1~deb12u2
CVE-2026-86145 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u1
CVE-2026-87018 HIGH undici 6.26.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-89157 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u1
CVE-2026-89161 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u1
CVE-2026-93749 HIGH source-map-js 1.2.1 1.2.2
CVE-2026-93990 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-9496 HIGH pacote 21.5.0 21.5.1
GHSA-2x7j-588g-ccc2 HIGH nodemailer 9.0.3 9.1.0
GHSA-8238-w5pm-2374 HIGH adm-zip 0.5.18 0.6.1
GHSA-f88m-g3jw-g9cj HIGH sharp 0.34.5 0.35.0
GHSA-rcw4-f5rp-g42v HIGH adm-zip 0.5.18 0.6.1
GHSA-rgj7-g3m4-5g8c HIGH sharp 0.34.5 0.35.4
GHSA-v53p-9fqp-m79j HIGH nodemailer 9.0.3 10.0.6
GHSA-wq5f-xc86-pv6w HIGH sharp 0.34.5 0.35.5

📦 git.rhoving.com/rbrooks/tealeaves-api:stable (64 CVEs)

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL libbrotli1 1.0.9-2+b6 1.0.9-2+deb12u1
CVE-2026-13221 CRITICAL libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-42496 CRITICAL libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-59873 CRITICAL tar 7.5.15 7.5.19
CVE-2026-8376 CRITICAL libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-90711 CRITICAL proxy-addr 2.0.7 2.0.8
CVE-2024-28757 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2025-59375 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u5
CVE-2026-0966 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-102276 HIGH brace-expansion 5.0.6 5.0.10, 3.0.7, 2.1.5, 1.1.19
CVE-2026-102278 HIGH brace-expansion 5.0.6 5.0.11, 3.0.8, 2.1.6, 1.1.20
CVE-2026-102282 HIGH adm-zip 0.5.18 0.6.1
CVE-2026-103111 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u2
CVE-2026-109383 HIGH undici 6.26.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-109518 HIGH apt 2.6.1 2.6.2
CVE-2026-109869 HIGH undici 6.26.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-111181 HIGH body-parser 2.3.0 2.4.0, 1.20.9
CVE-2026-113872 HIGH multer 2.2.0 2.5.0
CVE-2026-12151 HIGH undici 6.26.0 6.27.0, 7.28.0, 8.5.0
CVE-2026-13149 HIGH brace-expansion 5.0.6 5.0.7, 1.1.16, 2.1.2
CVE-2026-14257 HIGH brace-expansion 5.0.6 5.0.8, 3.0.3, 2.1.3, 1.1.17
CVE-2026-19534 HIGH undici 6.26.0 6.28.1, 7.29.1, 8.10.2
CVE-2026-25210 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-3731 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-39244 HIGH adm-zip 0.5.18 0.6.0
CVE-2026-42497 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-45186 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-48962 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-56208 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-56209 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-56210 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-56211 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-57432 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-57433 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-59847 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-59850 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-59874 HIGH tar 7.5.15 7.5.18
CVE-2026-61627 HIGH libass9 1:0.17.1-1 1:0.17.1-1+deb12u1
CVE-2026-66046 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-67213 HIGH nanoid 3.3.16 3.3.18, 5.1.6
CVE-2026-69152 HIGH brace-expansion 5.0.6 1.1.18, 2.1.4, 3.0.6, 5.0.9
CVE-2026-69192 HIGH ip-address 10.2.0 10.3.1
CVE-2026-73566 HIGH tar 7.5.15 7.5.21
CVE-2026-76957 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u3
CVE-2026-77037 HIGH multer 2.2.0 2.3.0
CVE-2026-77078 HIGH multer 2.2.0 2.3.0
CVE-2026-77214 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u5
CVE-2026-77301 HIGH adm-zip 0.5.18 0.6.1
CVE-2026-82333 HIGH multer 2.2.0 2.3.0
CVE-2026-84782 HIGH libssl3 3.0.20-1~deb12u2 3.0.22-1~deb12u2
CVE-2026-86145 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u1
CVE-2026-87018 HIGH undici 6.26.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-89157 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u1
CVE-2026-89161 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u1
CVE-2026-93749 HIGH source-map-js 1.2.1 1.2.2
CVE-2026-93990 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-9496 HIGH pacote 21.5.0 21.5.1
GHSA-2x7j-588g-ccc2 HIGH nodemailer 9.0.3 9.1.0
GHSA-8238-w5pm-2374 HIGH adm-zip 0.5.18 0.6.1
GHSA-f88m-g3jw-g9cj HIGH sharp 0.34.5 0.35.0
GHSA-rcw4-f5rp-g42v HIGH adm-zip 0.5.18 0.6.1
GHSA-rgj7-g3m4-5g8c HIGH sharp 0.34.5 0.35.4
GHSA-v53p-9fqp-m79j HIGH nodemailer 9.0.3 10.0.6
GHSA-wq5f-xc86-pv6w HIGH sharp 0.34.5 0.35.5

📦 git.rhoving.com/rbrooks/tealeaves-api:9.4.0 (64 CVEs)

Production-pinned — tealeaves_api_image in inventory/group_vars/tealeaves/vars.yml.

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL libbrotli1 1.0.9-2+b6 1.0.9-2+deb12u1
CVE-2026-13221 CRITICAL libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-42496 CRITICAL libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-59873 CRITICAL tar 7.5.15 7.5.19
CVE-2026-8376 CRITICAL libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-90711 CRITICAL proxy-addr 2.0.7 2.0.8
CVE-2024-28757 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2025-59375 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u5
CVE-2026-0966 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-102276 HIGH brace-expansion 5.0.6 5.0.10, 3.0.7, 2.1.5, 1.1.19
CVE-2026-102278 HIGH brace-expansion 5.0.6 5.0.11, 3.0.8, 2.1.6, 1.1.20
CVE-2026-102282 HIGH adm-zip 0.5.18 0.6.1
CVE-2026-103111 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u2
CVE-2026-109383 HIGH undici 6.26.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-109518 HIGH apt 2.6.1 2.6.2
CVE-2026-109869 HIGH undici 6.26.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-111181 HIGH body-parser 2.3.0 2.4.0, 1.20.9
CVE-2026-113872 HIGH multer 2.2.0 2.5.0
CVE-2026-12151 HIGH undici 6.26.0 6.27.0, 7.28.0, 8.5.0
CVE-2026-13149 HIGH brace-expansion 5.0.6 5.0.7, 1.1.16, 2.1.2
CVE-2026-14257 HIGH brace-expansion 5.0.6 5.0.8, 3.0.3, 2.1.3, 1.1.17
CVE-2026-19534 HIGH undici 6.26.0 6.28.1, 7.29.1, 8.10.2
CVE-2026-25210 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-3731 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-39244 HIGH adm-zip 0.5.18 0.6.0
CVE-2026-42497 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-45186 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-48962 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-56208 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-56209 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-56210 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-56211 HIGH libaom3 3.6.0-1+deb12u2 3.6.0-1+deb12u3
CVE-2026-57432 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-57433 HIGH libperl5.36 5.36.0-7+deb12u3 5.36.0-7+deb12u4
CVE-2026-59847 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-59850 HIGH libssh-gcrypt-4 0.10.6-0+deb12u2 0.10.6-0+deb12u3
CVE-2026-59874 HIGH tar 7.5.15 7.5.18
CVE-2026-61627 HIGH libass9 1:0.17.1-1 1:0.17.1-1+deb12u1
CVE-2026-66046 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-67213 HIGH nanoid 3.3.16 3.3.18, 5.1.6
CVE-2026-69152 HIGH brace-expansion 5.0.6 1.1.18, 2.1.4, 3.0.6, 5.0.9
CVE-2026-69192 HIGH ip-address 10.2.0 10.3.1
CVE-2026-73566 HIGH tar 7.5.15 7.5.21
CVE-2026-76957 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u3
CVE-2026-77037 HIGH multer 2.2.0 2.3.0
CVE-2026-77078 HIGH multer 2.2.0 2.3.0
CVE-2026-77214 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u5
CVE-2026-77301 HIGH adm-zip 0.5.18 0.6.1
CVE-2026-82333 HIGH multer 2.2.0 2.3.0
CVE-2026-84782 HIGH libssl3 3.0.20-1~deb12u2 3.0.22-1~deb12u2
CVE-2026-86145 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u1
CVE-2026-87018 HIGH undici 6.26.0 6.29.1, 7.30.1, 8.12.2
CVE-2026-89157 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u1
CVE-2026-89161 HIGH libpcre2-8-0 10.42-1 10.42-1+deb12u1
CVE-2026-93749 HIGH source-map-js 1.2.1 1.2.2
CVE-2026-93990 HIGH libexpat1 2.5.0-1+deb12u2 2.5.0-1+deb12u4
CVE-2026-9496 HIGH pacote 21.5.0 21.5.1
GHSA-2x7j-588g-ccc2 HIGH nodemailer 9.0.3 9.1.0
GHSA-8238-w5pm-2374 HIGH adm-zip 0.5.18 0.6.1
GHSA-f88m-g3jw-g9cj HIGH sharp 0.34.5 0.35.0
GHSA-rcw4-f5rp-g42v HIGH adm-zip 0.5.18 0.6.1
GHSA-rgj7-g3m4-5g8c HIGH sharp 0.34.5 0.35.4
GHSA-v53p-9fqp-m79j HIGH nodemailer 9.0.3 10.0.6
GHSA-wq5f-xc86-pv6w HIGH sharp 0.34.5 0.35.5

📦 git.rhoving.com/rbrooks/tealeaves-app:9.4.0 (28 CVEs)

Production-pinned — tealeaves_app_image in inventory/group_vars/tealeaves/vars.yml.

CVE Severity Package Installed Fixed
CVE-2026-111497 CRITICAL brotli-libs 1.2.0-r1 1.2.1-r0
CVE-2026-103111 HIGH pcre2 10.47-r1 10.49-r0
CVE-2026-107891 HIGH musl 1.2.6-r2 1.2.6-r3
CVE-2026-113351 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-115506 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-117610 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-118370 HIGH libexpat 2.8.2-r0 2.10.0-r0
CVE-2026-14456 HIGH libcrypto3 3.5.7-r0 3.5.8-r0
CVE-2026-4775 HIGH tiff 4.7.1-r0 4.7.2-r0
CVE-2026-53612 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-53613 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-53614 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-66046 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-76641 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-76642 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-76956 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-76957 HIGH libexpat 2.8.2-r0 2.8.4-r0
CVE-2026-77214 HIGH libexpat 2.8.2-r0 2.9.0-r0
CVE-2026-78408 HIGH libuuid 2.42.1-r0 2.42.3-r1
CVE-2026-78409 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-78410 HIGH libuuid 2.42.1-r0 2.42.3-r0
CVE-2026-85091 HIGH zlib 1.3.2-r0 1.3.2-r1
CVE-2026-86145 HIGH pcre2 10.47-r1 10.48-r0
CVE-2026-88806 HIGH libx11 1.8.13-r0 1.8.14-r0
CVE-2026-89157 HIGH pcre2 10.47-r1 10.48-r0
CVE-2026-89161 HIGH pcre2 10.47-r1 10.48-r0
CVE-2026-92392 HIGH curl 8.21.0-r0 8.23.0-r0
CVE-2026-93990 HIGH libexpat 2.8.2-r0 2.8.5-r0
<!-- fleet-security-scan --> ## Automated security scan Filed by the fleet security scanner (`.forgejo/workflows/security-scan.yml`). Re-runs update this issue. ### 📦 `git.rhoving.com/rbrooks/tealeaves-app:latest` (28 CVEs) | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `brotli-libs` | 1.2.0-r1 | 1.2.1-r0 | | CVE-2026-103111 | HIGH | `pcre2` | 10.47-r1 | 10.49-r0 | | CVE-2026-107891 | HIGH | `musl` | 1.2.6-r2 | 1.2.6-r3 | | CVE-2026-113351 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-115506 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-117610 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-118370 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-14456 | HIGH | `libcrypto3` | 3.5.7-r0 | 3.5.8-r0 | | CVE-2026-4775 | HIGH | `tiff` | 4.7.1-r0 | 4.7.2-r0 | | CVE-2026-53612 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-53613 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-53614 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-66046 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-76641 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-76642 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-76956 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-76957 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-77214 | HIGH | `libexpat` | 2.8.2-r0 | 2.9.0-r0 | | CVE-2026-78408 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r1 | | CVE-2026-78409 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-78410 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-85091 | HIGH | `zlib` | 1.3.2-r0 | 1.3.2-r1 | | CVE-2026-86145 | HIGH | `pcre2` | 10.47-r1 | 10.48-r0 | | CVE-2026-88806 | HIGH | `libx11` | 1.8.13-r0 | 1.8.14-r0 | | CVE-2026-89157 | HIGH | `pcre2` | 10.47-r1 | 10.48-r0 | | CVE-2026-89161 | HIGH | `pcre2` | 10.47-r1 | 10.48-r0 | | CVE-2026-92392 | HIGH | `curl` | 8.21.0-r0 | 8.23.0-r0 | | CVE-2026-93990 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.5-r0 | ### 📦 `git.rhoving.com/rbrooks/tealeaves-app:stable` (28 CVEs) | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `brotli-libs` | 1.2.0-r1 | 1.2.1-r0 | | CVE-2026-103111 | HIGH | `pcre2` | 10.47-r1 | 10.49-r0 | | CVE-2026-107891 | HIGH | `musl` | 1.2.6-r2 | 1.2.6-r3 | | CVE-2026-113351 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-115506 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-117610 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-118370 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-14456 | HIGH | `libcrypto3` | 3.5.7-r0 | 3.5.8-r0 | | CVE-2026-4775 | HIGH | `tiff` | 4.7.1-r0 | 4.7.2-r0 | | CVE-2026-53612 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-53613 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-53614 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-66046 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-76641 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-76642 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-76956 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-76957 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-77214 | HIGH | `libexpat` | 2.8.2-r0 | 2.9.0-r0 | | CVE-2026-78408 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r1 | | CVE-2026-78409 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-78410 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-85091 | HIGH | `zlib` | 1.3.2-r0 | 1.3.2-r1 | | CVE-2026-86145 | HIGH | `pcre2` | 10.47-r1 | 10.48-r0 | | CVE-2026-88806 | HIGH | `libx11` | 1.8.13-r0 | 1.8.14-r0 | | CVE-2026-89157 | HIGH | `pcre2` | 10.47-r1 | 10.48-r0 | | CVE-2026-89161 | HIGH | `pcre2` | 10.47-r1 | 10.48-r0 | | CVE-2026-92392 | HIGH | `curl` | 8.21.0-r0 | 8.23.0-r0 | | CVE-2026-93990 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.5-r0 | ### 📦 `git.rhoving.com/rbrooks/tealeaves-api:beta` (8 CVEs) **Production-pinned** — `tealeaves_api_image` in `inventory/host_vars/docker-test/vars.yml`. | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-102276 | HIGH | `brace-expansion` | 5.0.9 | 5.0.10, 3.0.7, 2.1.5, 1.1.19 | | CVE-2026-102278 | HIGH | `brace-expansion` | 5.0.9 | 5.0.11, 3.0.8, 2.1.6, 1.1.20 | | CVE-2026-109383 | HIGH | `undici` | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-109869 | HIGH | `undici` | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-19534 | HIGH | `undici` | 6.28.0 | 6.28.1, 7.29.1, 8.10.2 | | CVE-2026-87018 | HIGH | `undici` | 6.28.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-90776 | HIGH | `nodemailer` | 9.1.1 | 10.0.5 | | GHSA-v53p-9fqp-m79j | HIGH | `nodemailer` | 9.1.1 | 10.0.6 | ### 📦 `git.rhoving.com/rbrooks/tealeaves-api:latest` (64 CVEs) | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `libbrotli1` | 1.0.9-2+b6 | 1.0.9-2+deb12u1 | | CVE-2026-13221 | CRITICAL | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-42496 | CRITICAL | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-59873 | CRITICAL | `tar` | 7.5.15 | 7.5.19 | | CVE-2026-8376 | CRITICAL | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-90711 | CRITICAL | `proxy-addr` | 2.0.7 | 2.0.8 | | CVE-2024-28757 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2025-59375 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u5 | | CVE-2026-0966 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-102276 | HIGH | `brace-expansion` | 5.0.6 | 5.0.10, 3.0.7, 2.1.5, 1.1.19 | | CVE-2026-102278 | HIGH | `brace-expansion` | 5.0.6 | 5.0.11, 3.0.8, 2.1.6, 1.1.20 | | CVE-2026-102282 | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | CVE-2026-103111 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u2 | | CVE-2026-109383 | HIGH | `undici` | 6.26.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-109518 | HIGH | `apt` | 2.6.1 | 2.6.2 | | CVE-2026-109869 | HIGH | `undici` | 6.26.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-111181 | HIGH | `body-parser` | 2.3.0 | 2.4.0, 1.20.9 | | CVE-2026-113872 | HIGH | `multer` | 2.2.0 | 2.5.0 | | CVE-2026-12151 | HIGH | `undici` | 6.26.0 | 6.27.0, 7.28.0, 8.5.0 | | CVE-2026-13149 | HIGH | `brace-expansion` | 5.0.6 | 5.0.7, 1.1.16, 2.1.2 | | CVE-2026-14257 | HIGH | `brace-expansion` | 5.0.6 | 5.0.8, 3.0.3, 2.1.3, 1.1.17 | | CVE-2026-19534 | HIGH | `undici` | 6.26.0 | 6.28.1, 7.29.1, 8.10.2 | | CVE-2026-25210 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-3731 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-39244 | HIGH | `adm-zip` | 0.5.18 | 0.6.0 | | CVE-2026-42497 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-45186 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-48962 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-56208 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-56209 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-56210 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-56211 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-57432 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-57433 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-59847 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-59850 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-59874 | HIGH | `tar` | 7.5.15 | 7.5.18 | | CVE-2026-61627 | HIGH | `libass9` | 1:0.17.1-1 | 1:0.17.1-1+deb12u1 | | CVE-2026-66046 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-67213 | HIGH | `nanoid` | 3.3.16 | 3.3.18, 5.1.6 | | CVE-2026-69152 | HIGH | `brace-expansion` | 5.0.6 | 1.1.18, 2.1.4, 3.0.6, 5.0.9 | | CVE-2026-69192 | HIGH | `ip-address` | 10.2.0 | 10.3.1 | | CVE-2026-73566 | HIGH | `tar` | 7.5.15 | 7.5.21 | | CVE-2026-76957 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u3 | | CVE-2026-77037 | HIGH | `multer` | 2.2.0 | 2.3.0 | | CVE-2026-77078 | HIGH | `multer` | 2.2.0 | 2.3.0 | | CVE-2026-77214 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u5 | | CVE-2026-77301 | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | CVE-2026-82333 | HIGH | `multer` | 2.2.0 | 2.3.0 | | CVE-2026-84782 | HIGH | `libssl3` | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u2 | | CVE-2026-86145 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u1 | | CVE-2026-87018 | HIGH | `undici` | 6.26.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-89157 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u1 | | CVE-2026-89161 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u1 | | CVE-2026-93749 | HIGH | `source-map-js` | 1.2.1 | 1.2.2 | | CVE-2026-93990 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-9496 | HIGH | `pacote` | 21.5.0 | 21.5.1 | | GHSA-2x7j-588g-ccc2 | HIGH | `nodemailer` | 9.0.3 | 9.1.0 | | GHSA-8238-w5pm-2374 | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | GHSA-f88m-g3jw-g9cj | HIGH | `sharp` | 0.34.5 | 0.35.0 | | GHSA-rcw4-f5rp-g42v | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | GHSA-rgj7-g3m4-5g8c | HIGH | `sharp` | 0.34.5 | 0.35.4 | | GHSA-v53p-9fqp-m79j | HIGH | `nodemailer` | 9.0.3 | 10.0.6 | | GHSA-wq5f-xc86-pv6w | HIGH | `sharp` | 0.34.5 | 0.35.5 | ### 📦 `git.rhoving.com/rbrooks/tealeaves-api:stable` (64 CVEs) | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `libbrotli1` | 1.0.9-2+b6 | 1.0.9-2+deb12u1 | | CVE-2026-13221 | CRITICAL | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-42496 | CRITICAL | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-59873 | CRITICAL | `tar` | 7.5.15 | 7.5.19 | | CVE-2026-8376 | CRITICAL | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-90711 | CRITICAL | `proxy-addr` | 2.0.7 | 2.0.8 | | CVE-2024-28757 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2025-59375 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u5 | | CVE-2026-0966 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-102276 | HIGH | `brace-expansion` | 5.0.6 | 5.0.10, 3.0.7, 2.1.5, 1.1.19 | | CVE-2026-102278 | HIGH | `brace-expansion` | 5.0.6 | 5.0.11, 3.0.8, 2.1.6, 1.1.20 | | CVE-2026-102282 | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | CVE-2026-103111 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u2 | | CVE-2026-109383 | HIGH | `undici` | 6.26.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-109518 | HIGH | `apt` | 2.6.1 | 2.6.2 | | CVE-2026-109869 | HIGH | `undici` | 6.26.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-111181 | HIGH | `body-parser` | 2.3.0 | 2.4.0, 1.20.9 | | CVE-2026-113872 | HIGH | `multer` | 2.2.0 | 2.5.0 | | CVE-2026-12151 | HIGH | `undici` | 6.26.0 | 6.27.0, 7.28.0, 8.5.0 | | CVE-2026-13149 | HIGH | `brace-expansion` | 5.0.6 | 5.0.7, 1.1.16, 2.1.2 | | CVE-2026-14257 | HIGH | `brace-expansion` | 5.0.6 | 5.0.8, 3.0.3, 2.1.3, 1.1.17 | | CVE-2026-19534 | HIGH | `undici` | 6.26.0 | 6.28.1, 7.29.1, 8.10.2 | | CVE-2026-25210 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-3731 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-39244 | HIGH | `adm-zip` | 0.5.18 | 0.6.0 | | CVE-2026-42497 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-45186 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-48962 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-56208 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-56209 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-56210 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-56211 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-57432 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-57433 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-59847 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-59850 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-59874 | HIGH | `tar` | 7.5.15 | 7.5.18 | | CVE-2026-61627 | HIGH | `libass9` | 1:0.17.1-1 | 1:0.17.1-1+deb12u1 | | CVE-2026-66046 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-67213 | HIGH | `nanoid` | 3.3.16 | 3.3.18, 5.1.6 | | CVE-2026-69152 | HIGH | `brace-expansion` | 5.0.6 | 1.1.18, 2.1.4, 3.0.6, 5.0.9 | | CVE-2026-69192 | HIGH | `ip-address` | 10.2.0 | 10.3.1 | | CVE-2026-73566 | HIGH | `tar` | 7.5.15 | 7.5.21 | | CVE-2026-76957 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u3 | | CVE-2026-77037 | HIGH | `multer` | 2.2.0 | 2.3.0 | | CVE-2026-77078 | HIGH | `multer` | 2.2.0 | 2.3.0 | | CVE-2026-77214 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u5 | | CVE-2026-77301 | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | CVE-2026-82333 | HIGH | `multer` | 2.2.0 | 2.3.0 | | CVE-2026-84782 | HIGH | `libssl3` | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u2 | | CVE-2026-86145 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u1 | | CVE-2026-87018 | HIGH | `undici` | 6.26.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-89157 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u1 | | CVE-2026-89161 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u1 | | CVE-2026-93749 | HIGH | `source-map-js` | 1.2.1 | 1.2.2 | | CVE-2026-93990 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-9496 | HIGH | `pacote` | 21.5.0 | 21.5.1 | | GHSA-2x7j-588g-ccc2 | HIGH | `nodemailer` | 9.0.3 | 9.1.0 | | GHSA-8238-w5pm-2374 | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | GHSA-f88m-g3jw-g9cj | HIGH | `sharp` | 0.34.5 | 0.35.0 | | GHSA-rcw4-f5rp-g42v | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | GHSA-rgj7-g3m4-5g8c | HIGH | `sharp` | 0.34.5 | 0.35.4 | | GHSA-v53p-9fqp-m79j | HIGH | `nodemailer` | 9.0.3 | 10.0.6 | | GHSA-wq5f-xc86-pv6w | HIGH | `sharp` | 0.34.5 | 0.35.5 | ### 📦 `git.rhoving.com/rbrooks/tealeaves-api:9.4.0` (64 CVEs) **Production-pinned** — `tealeaves_api_image` in `inventory/group_vars/tealeaves/vars.yml`. | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `libbrotli1` | 1.0.9-2+b6 | 1.0.9-2+deb12u1 | | CVE-2026-13221 | CRITICAL | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-42496 | CRITICAL | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-59873 | CRITICAL | `tar` | 7.5.15 | 7.5.19 | | CVE-2026-8376 | CRITICAL | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-90711 | CRITICAL | `proxy-addr` | 2.0.7 | 2.0.8 | | CVE-2024-28757 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2025-59375 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u5 | | CVE-2026-0966 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-102276 | HIGH | `brace-expansion` | 5.0.6 | 5.0.10, 3.0.7, 2.1.5, 1.1.19 | | CVE-2026-102278 | HIGH | `brace-expansion` | 5.0.6 | 5.0.11, 3.0.8, 2.1.6, 1.1.20 | | CVE-2026-102282 | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | CVE-2026-103111 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u2 | | CVE-2026-109383 | HIGH | `undici` | 6.26.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-109518 | HIGH | `apt` | 2.6.1 | 2.6.2 | | CVE-2026-109869 | HIGH | `undici` | 6.26.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-111181 | HIGH | `body-parser` | 2.3.0 | 2.4.0, 1.20.9 | | CVE-2026-113872 | HIGH | `multer` | 2.2.0 | 2.5.0 | | CVE-2026-12151 | HIGH | `undici` | 6.26.0 | 6.27.0, 7.28.0, 8.5.0 | | CVE-2026-13149 | HIGH | `brace-expansion` | 5.0.6 | 5.0.7, 1.1.16, 2.1.2 | | CVE-2026-14257 | HIGH | `brace-expansion` | 5.0.6 | 5.0.8, 3.0.3, 2.1.3, 1.1.17 | | CVE-2026-19534 | HIGH | `undici` | 6.26.0 | 6.28.1, 7.29.1, 8.10.2 | | CVE-2026-25210 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-3731 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-39244 | HIGH | `adm-zip` | 0.5.18 | 0.6.0 | | CVE-2026-42497 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-45186 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-48962 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-56208 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-56209 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-56210 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-56211 | HIGH | `libaom3` | 3.6.0-1+deb12u2 | 3.6.0-1+deb12u3 | | CVE-2026-57432 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-57433 | HIGH | `libperl5.36` | 5.36.0-7+deb12u3 | 5.36.0-7+deb12u4 | | CVE-2026-59847 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-59850 | HIGH | `libssh-gcrypt-4` | 0.10.6-0+deb12u2 | 0.10.6-0+deb12u3 | | CVE-2026-59874 | HIGH | `tar` | 7.5.15 | 7.5.18 | | CVE-2026-61627 | HIGH | `libass9` | 1:0.17.1-1 | 1:0.17.1-1+deb12u1 | | CVE-2026-66046 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-67213 | HIGH | `nanoid` | 3.3.16 | 3.3.18, 5.1.6 | | CVE-2026-69152 | HIGH | `brace-expansion` | 5.0.6 | 1.1.18, 2.1.4, 3.0.6, 5.0.9 | | CVE-2026-69192 | HIGH | `ip-address` | 10.2.0 | 10.3.1 | | CVE-2026-73566 | HIGH | `tar` | 7.5.15 | 7.5.21 | | CVE-2026-76957 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u3 | | CVE-2026-77037 | HIGH | `multer` | 2.2.0 | 2.3.0 | | CVE-2026-77078 | HIGH | `multer` | 2.2.0 | 2.3.0 | | CVE-2026-77214 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u5 | | CVE-2026-77301 | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | CVE-2026-82333 | HIGH | `multer` | 2.2.0 | 2.3.0 | | CVE-2026-84782 | HIGH | `libssl3` | 3.0.20-1~deb12u2 | 3.0.22-1~deb12u2 | | CVE-2026-86145 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u1 | | CVE-2026-87018 | HIGH | `undici` | 6.26.0 | 6.29.1, 7.30.1, 8.12.2 | | CVE-2026-89157 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u1 | | CVE-2026-89161 | HIGH | `libpcre2-8-0` | 10.42-1 | 10.42-1+deb12u1 | | CVE-2026-93749 | HIGH | `source-map-js` | 1.2.1 | 1.2.2 | | CVE-2026-93990 | HIGH | `libexpat1` | 2.5.0-1+deb12u2 | 2.5.0-1+deb12u4 | | CVE-2026-9496 | HIGH | `pacote` | 21.5.0 | 21.5.1 | | GHSA-2x7j-588g-ccc2 | HIGH | `nodemailer` | 9.0.3 | 9.1.0 | | GHSA-8238-w5pm-2374 | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | GHSA-f88m-g3jw-g9cj | HIGH | `sharp` | 0.34.5 | 0.35.0 | | GHSA-rcw4-f5rp-g42v | HIGH | `adm-zip` | 0.5.18 | 0.6.1 | | GHSA-rgj7-g3m4-5g8c | HIGH | `sharp` | 0.34.5 | 0.35.4 | | GHSA-v53p-9fqp-m79j | HIGH | `nodemailer` | 9.0.3 | 10.0.6 | | GHSA-wq5f-xc86-pv6w | HIGH | `sharp` | 0.34.5 | 0.35.5 | ### 📦 `git.rhoving.com/rbrooks/tealeaves-app:9.4.0` (28 CVEs) **Production-pinned** — `tealeaves_app_image` in `inventory/group_vars/tealeaves/vars.yml`. | CVE | Severity | Package | Installed | Fixed | |-----|----------|---------|-----------|-------| | CVE-2026-111497 | CRITICAL | `brotli-libs` | 1.2.0-r1 | 1.2.1-r0 | | CVE-2026-103111 | HIGH | `pcre2` | 10.47-r1 | 10.49-r0 | | CVE-2026-107891 | HIGH | `musl` | 1.2.6-r2 | 1.2.6-r3 | | CVE-2026-113351 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-115506 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-117610 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-118370 | HIGH | `libexpat` | 2.8.2-r0 | 2.10.0-r0 | | CVE-2026-14456 | HIGH | `libcrypto3` | 3.5.7-r0 | 3.5.8-r0 | | CVE-2026-4775 | HIGH | `tiff` | 4.7.1-r0 | 4.7.2-r0 | | CVE-2026-53612 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-53613 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-53614 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-66046 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-76641 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-76642 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-76956 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-76957 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.4-r0 | | CVE-2026-77214 | HIGH | `libexpat` | 2.8.2-r0 | 2.9.0-r0 | | CVE-2026-78408 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r1 | | CVE-2026-78409 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-78410 | HIGH | `libuuid` | 2.42.1-r0 | 2.42.3-r0 | | CVE-2026-85091 | HIGH | `zlib` | 1.3.2-r0 | 1.3.2-r1 | | CVE-2026-86145 | HIGH | `pcre2` | 10.47-r1 | 10.48-r0 | | CVE-2026-88806 | HIGH | `libx11` | 1.8.13-r0 | 1.8.14-r0 | | CVE-2026-89157 | HIGH | `pcre2` | 10.47-r1 | 10.48-r0 | | CVE-2026-89161 | HIGH | `pcre2` | 10.47-r1 | 10.48-r0 | | CVE-2026-92392 | HIGH | `curl` | 8.21.0-r0 | 8.23.0-r0 | | CVE-2026-93990 | HIGH | `libexpat` | 2.8.2-r0 | 2.8.5-r0 |
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/altcha-lib-2.x
renovate/altcha-3.x
deps/wave-1-low-risk
v9.4.0
v9.3.0
v9.2.0
v9.1.0
v9.0.0
v8.0.0
v7.3.0
v7.2.1
v7.2.0
v7.1.0
v7.0.0
v6.2.0
v6.1.0
v6.0.0
v5.0.1
v5.0.0
v4.0.0
v3.0.0
v2.0
v1.0.0
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
future
Unscoped / not yet prioritized — no milestone

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
security
Security hardening / vulnerability work

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
future
help wanted
invalid
question
security
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rbrooks/TeaLeaves#182
No description provided.