bvandeusen/StashHandler
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Security Dashboard #3

New Issue
Open
opened 2026-08-09 20:59:32 -04:00 by renovate-bot · 0 comments
renovate-bot commented 2026-08-09 20:59:32 -04:00
Copy Link
Copy Source

Automated weekly security sweep — last rewritten 2026-10-19 07:33 UTC (runs).

This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them with a written reason (this repo's .gitleaks.toml for secrets, an inline # nosemgrep: <rule-id> -- <reason> for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface.

Secrets (gitleaks)

Clean — no findings.

Code findings (semgrep, curated family ruleset)

Clean — no findings.

Dependency CVEs (osv-scanner)

Clean — no findings.

Published image (trivy)

  • HIGH CVE-2026-53612 — bsdutils 1:2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53613 — bsdutils 1:2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53614 — bsdutils 1:2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53615 — bsdutils 1:2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-76642 — bsdutils 1:2.41-5 (no fix released)
  • HIGH CVE-2026-78408 — bsdutils 1:2.41-5 (no fix released)
  • HIGH CVE-2026-78409 — bsdutils 1:2.41-5 (no fix released)
  • HIGH CVE-2026-78410 — bsdutils 1:2.41-5 (no fix released)
  • HIGH CVE-2026-41992 — gzip 1.13-1 → fixed in 1.13-1+deb13u1
  • HIGH CVE-2026-54369 — libacl1 2.3.2-2+b1 (no fix released)
  • HIGH CVE-2026-53612 — libblkid1 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53613 — libblkid1 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53614 — libblkid1 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53615 — libblkid1 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-76642 — libblkid1 2.41-5 (no fix released)
  • HIGH CVE-2026-78408 — libblkid1 2.41-5 (no fix released)
  • HIGH CVE-2026-78409 — libblkid1 2.41-5 (no fix released)
  • HIGH CVE-2026-78410 — libblkid1 2.41-5 (no fix released)
  • HIGH CVE-2026-53612 — liblastlog2-2 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53613 — liblastlog2-2 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53614 — liblastlog2-2 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53615 — liblastlog2-2 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-76642 — liblastlog2-2 2.41-5 (no fix released)
  • HIGH CVE-2026-78408 — liblastlog2-2 2.41-5 (no fix released)
  • HIGH CVE-2026-78409 — liblastlog2-2 2.41-5 (no fix released)
  • HIGH CVE-2026-78410 — liblastlog2-2 2.41-5 (no fix released)
  • HIGH CVE-2026-53612 — libmount1 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53613 — libmount1 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53614 — libmount1 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-53615 — libmount1 2.41-5 → fixed in 2.41.5-0+deb13u1
  • HIGH CVE-2026-76642 — libmount1 2.41-5 (no fix released)
  • HIGH CVE-2026-78408 — libmount1 2.41-5 (no fix released)
  • HIGH CVE-2026-78409 — libmount1 2.41-5 (no fix released)
  • HIGH CVE-2026-78410 — libmount1 2.41-5 (no fix released)
  • HIGH CVE-2025-69720 — libncursesw6 6.5+20250216-2 (no fix released)
  • HIGH CVE-2026-103111 — libpcre2-8-0 10.46-1~deb13u1 → fixed in 10.46-1~deb13u3
  • HIGH CVE-2026-86145 — libpcre2-8-0 10.46-1~deb13u1 → fixed in 10.46-1~deb13u2
  • HIGH CVE-2026-89157 — libpcre2-8-0 10.46-1~deb13u1 → fixed in 10.46-1~deb13u2
  • HIGH CVE-2026-89161 — libpcre2-8-0 10.46-1~deb13u1 → fixed in 10.46-1~deb13u2
  • HIGH CVE-2026-53612 — libsmartcols1 2.41-5 → fixed in 2.41.5-0+deb13u1
    …and 63 more line(s) truncated — run the scanner locally or trigger the sweep with only= for the full list.

Coverage & limits

  • All four scanners ran with nothing skipped.
<!-- fabledsentry-security-dashboard --> _Automated weekly security sweep — last rewritten 2026-10-19 07:33 UTC ([runs](https://git.fabledsword.com/bvandeusen/CI-runner/actions))._ This issue is maintained like the Renovate Dependency Dashboard: every sweep run rewrites it in place. Don't edit findings here — fix them, or allowlist them **with a written reason** (this repo's `.gitleaks.toml` for secrets, an inline `# nosemgrep: <rule-id> -- <reason>` for code findings). There is no per-push security lane; this dashboard and the on-demand deep review are where security findings surface. ## Secrets (gitleaks) Clean — no findings. ## Code findings (semgrep, curated family ruleset) Clean — no findings. ## Dependency CVEs (osv-scanner) Clean — no findings. ## Published image (trivy) - **HIGH** CVE-2026-53612 — `bsdutils 1:2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53613 — `bsdutils 1:2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53614 — `bsdutils 1:2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53615 — `bsdutils 1:2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-76642 — `bsdutils 1:2.41-5` (no fix released) - **HIGH** CVE-2026-78408 — `bsdutils 1:2.41-5` (no fix released) - **HIGH** CVE-2026-78409 — `bsdutils 1:2.41-5` (no fix released) - **HIGH** CVE-2026-78410 — `bsdutils 1:2.41-5` (no fix released) - **HIGH** CVE-2026-41992 — `gzip 1.13-1` → fixed in 1.13-1+deb13u1 - **HIGH** CVE-2026-54369 — `libacl1 2.3.2-2+b1` (no fix released) - **HIGH** CVE-2026-53612 — `libblkid1 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53613 — `libblkid1 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53614 — `libblkid1 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53615 — `libblkid1 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-76642 — `libblkid1 2.41-5` (no fix released) - **HIGH** CVE-2026-78408 — `libblkid1 2.41-5` (no fix released) - **HIGH** CVE-2026-78409 — `libblkid1 2.41-5` (no fix released) - **HIGH** CVE-2026-78410 — `libblkid1 2.41-5` (no fix released) - **HIGH** CVE-2026-53612 — `liblastlog2-2 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53613 — `liblastlog2-2 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53614 — `liblastlog2-2 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53615 — `liblastlog2-2 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-76642 — `liblastlog2-2 2.41-5` (no fix released) - **HIGH** CVE-2026-78408 — `liblastlog2-2 2.41-5` (no fix released) - **HIGH** CVE-2026-78409 — `liblastlog2-2 2.41-5` (no fix released) - **HIGH** CVE-2026-78410 — `liblastlog2-2 2.41-5` (no fix released) - **HIGH** CVE-2026-53612 — `libmount1 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53613 — `libmount1 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53614 — `libmount1 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-53615 — `libmount1 2.41-5` → fixed in 2.41.5-0+deb13u1 - **HIGH** CVE-2026-76642 — `libmount1 2.41-5` (no fix released) - **HIGH** CVE-2026-78408 — `libmount1 2.41-5` (no fix released) - **HIGH** CVE-2026-78409 — `libmount1 2.41-5` (no fix released) - **HIGH** CVE-2026-78410 — `libmount1 2.41-5` (no fix released) - **HIGH** CVE-2025-69720 — `libncursesw6 6.5+20250216-2` (no fix released) - **HIGH** CVE-2026-103111 — `libpcre2-8-0 10.46-1~deb13u1` → fixed in 10.46-1~deb13u3 - **HIGH** CVE-2026-86145 — `libpcre2-8-0 10.46-1~deb13u1` → fixed in 10.46-1~deb13u2 - **HIGH** CVE-2026-89157 — `libpcre2-8-0 10.46-1~deb13u1` → fixed in 10.46-1~deb13u2 - **HIGH** CVE-2026-89161 — `libpcre2-8-0 10.46-1~deb13u1` → fixed in 10.46-1~deb13u2 - **HIGH** CVE-2026-53612 — `libsmartcols1 2.41-5` → fixed in 2.41.5-0+deb13u1 _…and 63 more line(s) truncated — run the scanner locally or trigger the sweep with `only=` for the full list._ ## Coverage & limits - All four scanners ran with nothing skipped.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
bvandeusen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: bvandeusen/StashHandler#3