{
 "arch": "arm64",
 "findings": [
  {
   "affects": [
    "util-linux"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-13595",
   "severity": "medium",
   "title": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array.",
   "url": "https://ubuntu.com/security/CVE-2026-13595"
  },
  {
   "affects": [
    "util-linux"
   ],
   "cvss": 5.3,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-3184",
   "severity": "medium",
   "title": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`.",
   "url": "https://ubuntu.com/security/CVE-2026-3184"
  },
  {
   "affects": [
    "util-linux"
   ],
   "cvss": 4.7,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-27456",
   "severity": "medium",
   "title": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux.",
   "url": "https://ubuntu.com/security/CVE-2026-27456"
  },
  {
   "affects": [
    "util-linux"
   ],
   "cvss": null,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-53612",
   "severity": "medium",
   "title": "CVE-2026-53612",
   "url": "https://ubuntu.com/security/CVE-2026-53612"
  },
  {
   "affects": [
    "util-linux"
   ],
   "cvss": null,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-53613",
   "severity": "medium",
   "title": "CVE-2026-53613",
   "url": "https://ubuntu.com/security/CVE-2026-53613"
  },
  {
   "affects": [
    "util-linux"
   ],
   "cvss": null,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-53614",
   "severity": "medium",
   "title": "CVE-2026-53614",
   "url": "https://ubuntu.com/security/CVE-2026-53614"
  },
  {
   "affects": [
    "util-linux"
   ],
   "cvss": null,
   "distro_severity": "medium",
   "fix_state": "not-fixed",
   "fixed_in": [],
   "id": "CVE-2026-53615",
   "severity": "medium",
   "title": "CVE-2026-53615",
   "url": "https://ubuntu.com/security/CVE-2026-53615"
  }
 ],
 "findings_changed_at": "2026-08-30T09:47:03Z",
 "image": "util-linux",
 "inputs": {
  "sbom_sha256": "e5c806bb40f66a364ad818297e884979dca42e69ccea626b83e671de05e92268"
 },
 "platform_digest": "sha256:aa79be3cfa7817210acafe5331a10b3c4902339c09a93078a58eba5ef8438388",
 "project": "util-linux",
 "receipt_sha256": "ff9e350b127e8ee206ec23cd9034dffec59023ca1ec60dd1d805c82c6e78bc70",
 "scanner": "grype",
 "severity_counts": {
  "critical": 0,
  "high": 0,
  "low": 0,
  "medium": 7,
  "unknown": 0
 },
 "suppressed": [],
 "version": "2.41.3",
 "vex_applied": [
  "util-linux-2.41.3-arm64.vex.json",
  "util-linux-2.41.3-arm64.ubuntu-vex.json"
 ]
}