{
 "arch": "arm64",
 "findings": [
  {
   "affects": [
    "curl"
   ],
   "cvss": 9.8,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-19931",
   "severity": "critical",
   "title": "A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials.",
   "url": "https://ubuntu.com/security/CVE-2026-19931"
  },
  {
   "affects": [
    "curl"
   ],
   "cvss": 9.1,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-18924",
   "severity": "critical",
   "title": "A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.",
   "url": "https://ubuntu.com/security/CVE-2026-18924"
  },
  {
   "affects": [
    "openssl"
   ],
   "cvss": 9.1,
   "distro_severity": "low",
   "fix_state": "fixed",
   "fixed_in": [
    "3.5.5-1ubuntu3.5"
   ],
   "id": "CVE-2026-75803",
   "severity": "critical",
   "title": "Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function.",
   "url": "https://ubuntu.com/security/CVE-2026-75803"
  },
  {
   "affects": [
    "libssh2"
   ],
   "cvss": 8.7,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "1.11.1-1ubuntu0.26.04.4"
   ],
   "id": "CVE-2026-66032",
   "severity": "high",
   "title": "libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session.",
   "url": "https://ubuntu.com/security/CVE-2026-66032"
  },
  {
   "affects": [
    "libssh2"
   ],
   "cvss": 8.7,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "1.11.1-1ubuntu0.26.04.4"
   ],
   "id": "CVE-2026-66033",
   "severity": "high",
   "title": "libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a malicious SSH server to crash any connecting client by\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-66033"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 8.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-74860",
   "severity": "high",
   "title": "A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values.",
   "url": "https://ubuntu.com/security/CVE-2026-74860"
  },
  {
   "affects": [
    "zlib"
   ],
   "cvss": 8.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-85091",
   "severity": "high",
   "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.",
   "url": "https://ubuntu.com/security/CVE-2026-85091"
  },
  {
   "affects": [
    "curl"
   ],
   "cvss": 8.2,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-82209",
   "severity": "high",
   "title": "When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g.\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-82209"
  },
  {
   "affects": [
    "pcre2"
   ],
   "cvss": 8.2,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-86145",
   "severity": "high",
   "title": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-86145"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 7.8,
   "distro_severity": "negligible",
   "fix_state": "wont-fix",
   "fixed_in": [],
   "id": "CVE-2026-11979",
   "severity": "high",
   "title": "libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking.",
   "url": "https://ubuntu.com/security/CVE-2026-11979"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 7.8,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-86138",
   "severity": "high",
   "title": "In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.",
   "url": "https://ubuntu.com/security/CVE-2026-86138"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 7.8,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-86139",
   "severity": "high",
   "title": "In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.",
   "url": "https://ubuntu.com/security/CVE-2026-86139"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 7.8,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-86140",
   "severity": "high",
   "title": "In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.",
   "url": "https://ubuntu.com/security/CVE-2026-86140"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 7.8,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-86142",
   "severity": "high",
   "title": "In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.",
   "url": "https://ubuntu.com/security/CVE-2026-86142"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 7.8,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-86144",
   "severity": "high",
   "title": "In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-86144"
  },
  {
   "affects": [
    "libssh2"
   ],
   "cvss": 7.7,
   "distro_severity": "medium",
   "fix_state": "fixed",
   "fixed_in": [
    "1.11.1-1ubuntu0.26.04.4"
   ],
   "id": "CVE-2026-66035",
   "severity": "high",
   "title": "libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in any connecting client by sending a packet with a packet_length\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-66035"
  },
  {
   "affects": [
    "curl"
   ],
   "cvss": 7.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-80229",
   "severity": "high",
   "title": "When performing transfers via libcurl\u2019s multi interface, pooled TLS connections can outlive their originating easy handles.",
   "url": "https://ubuntu.com/security/CVE-2026-80229"
  },
  {
   "affects": [
    "curl"
   ],
   "cvss": 7.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-80230",
   "severity": "high",
   "title": "When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-80230"
  },
  {
   "affects": [
    "curl"
   ],
   "cvss": 7.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-80255",
   "severity": "high",
   "title": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag.",
   "url": "https://ubuntu.com/security/CVE-2026-80255"
  },
  {
   "affects": [
    "curl"
   ],
   "cvss": 7.5,
   "distro_severity": "low",
   "fix_state": "fixed",
   "fixed_in": [
    "8.18.0-1ubuntu2.5"
   ],
   "id": "CVE-2026-8932",
   "severity": "high",
   "title": "libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse.",
   "url": "https://ubuntu.com/security/CVE-2026-8932"
  },
  {
   "affects": [
    "curl"
   ],
   "cvss": 7.4,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-13608",
   "severity": "high",
   "title": "A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification.",
   "url": "https://ubuntu.com/security/CVE-2026-13608"
  },
  {
   "affects": [
    "pcre2"
   ],
   "cvss": 7.4,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-89161",
   "severity": "high",
   "title": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.",
   "url": "https://ubuntu.com/security/CVE-2026-89161"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 7.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-86143",
   "severity": "high",
   "title": "In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback.",
   "url": "https://ubuntu.com/security/CVE-2026-86143"
  },
  {
   "affects": [
    "pcre2"
   ],
   "cvss": 6.5,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-89158",
   "severity": "medium",
   "title": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write.",
   "url": "https://ubuntu.com/security/CVE-2026-89158"
  },
  {
   "affects": [
    "p11-kit"
   ],
   "cvss": 6.2,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-13757",
   "severity": "medium",
   "title": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-13757"
  },
  {
   "affects": [
    "p11-kit"
   ],
   "cvss": 6.2,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-18938",
   "severity": "medium",
   "title": "A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability.",
   "url": "https://ubuntu.com/security/CVE-2026-18938"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 6.1,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-86137",
   "severity": "medium",
   "title": "In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.",
   "url": "https://ubuntu.com/security/CVE-2026-86137"
  },
  {
   "affects": [
    "pcre2"
   ],
   "cvss": 5.7,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-89157",
   "severity": "medium",
   "title": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.",
   "url": "https://ubuntu.com/security/CVE-2026-89157"
  },
  {
   "affects": [
    "sqlite3"
   ],
   "cvss": 4.0,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-39113",
   "severity": "medium",
   "title": "Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)\u2026",
   "url": "https://ubuntu.com/security/CVE-2026-39113"
  },
  {
   "affects": [
    "pcre2"
   ],
   "cvss": 3.7,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-89160",
   "severity": "low",
   "title": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject.",
   "url": "https://ubuntu.com/security/CVE-2026-89160"
  },
  {
   "affects": [
    "libxml2"
   ],
   "cvss": 3.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-86141",
   "severity": "low",
   "title": "xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.",
   "url": "https://ubuntu.com/security/CVE-2026-86141"
  },
  {
   "affects": [
    "pcre2"
   ],
   "cvss": 2.9,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-89156",
   "severity": "low",
   "title": "PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data.",
   "url": "https://ubuntu.com/security/CVE-2026-89156"
  },
  {
   "affects": [
    "pcre2"
   ],
   "cvss": 2.9,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-89162",
   "severity": "low",
   "title": "In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary, typically in a situation where the access available to the adversary is already unsafe.",
   "url": "https://ubuntu.com/security/CVE-2026-89162"
  }
 ],
 "findings_changed_at": "2026-09-16T13:22:27Z",
 "image": "php",
 "inputs": {
  "sbom_sha256": "2e5dae4b1f427558916854b295ef6e536b35e75b7f8ecbadf84b558d32546616"
 },
 "platform_digest": "sha256:2526e7d5509a7449fcfc1b8e8ef7206bc9cf672e5c7bd5c764afb54aea0309f3",
 "project": "php",
 "receipt_sha256": "de7c983149ea515901b2ed1e55c1c4f032a4834ebc22f4e8df5b7902859eef25",
 "scanner": "grype",
 "severity_counts": {
  "critical": 3,
  "high": 20,
  "low": 4,
  "medium": 6,
  "unknown": 0
 },
 "suppressed": [
  {
   "affects": [
    "zlib"
   ],
   "by": "vex",
   "id": "CVE-2026-27171"
  },
  {
   "affects": [
    "bzip2"
   ],
   "by": "vex",
   "id": "CVE-2026-42250"
  }
 ],
 "version": "8.5.10",
 "vex_applied": [
  "php-8.5.10-arm64.vex.json",
  "php-8.5.10-arm64.ubuntu-vex.json"
 ]
}