Severity: low (AVG-2882), medium (AVG-2893) — both open upstream, no fix version published by the Arch
Security Team.
pacman -Qu on blankpad = 0 outdated packages (sync DBs refreshed 2026-10-20); all 1359 installed packages
were matched against https://security.archlinux.org/issues/all.json (2446 advisories) keyed on pkgbase,
with a control test on deliberately old versions that produced 5 hits. Result: 0 packages matched an advisory
whose fix version is newer than installed. The two exceptions are advisories with an empty fix field:
Plus the standing housekeeping item: installed linux-cachyos 7.2.11-1 vs running 7.2.9-1-cachyos — the
reboot is pending, so the running kernel is not the package the audit scored, and Arch's tracker lists linux,
not linux-cachyos, so the running kernel is unverifiable by that source.
Action: nothing to install — watch both AVGs for a fix publication, and schedule the reboot window.
**Severity:** low (AVG-2882), medium (AVG-2893) — both open upstream, no fix version published by the Arch
Security Team.
`pacman -Qu` on blankpad = 0 outdated packages (sync DBs refreshed 2026-10-20); all 1359 installed packages
were matched against `https://security.archlinux.org/issues/all.json` (2446 advisories) keyed on **pkgbase**,
with a control test on deliberately old versions that produced 5 hits. Result: 0 packages matched an advisory
whose fix version is newer than installed. The two exceptions are advisories with an *empty* fix field:
| Package | Installed | Advisory | State |
|---|---|---|---|
| openssl | 3.6.5-1.1 | [AVG-2882](https://security.archlinux.org/AVG-2882) (CVE-2025-4575, low) | affected baseline 3.5.0-1, `fixed` empty |
| systemd | 262.1-1 | [AVG-2893](https://security.archlinux.org/AVG-2893) (CVE-2025-4598, medium) | affected baseline 257.6-1, `fixed` empty |
Plus the standing housekeeping item: installed `linux-cachyos 7.2.11-1` vs running `7.2.9-1-cachyos` — the
reboot is pending, so the running kernel is not the package the audit scored, and Arch's tracker lists `linux`,
not `linux-cachyos`, so the running kernel is unverifiable by that source.
**Action:** nothing to install — watch both AVGs for a fix publication, and schedule the reboot window.
Source: [vuln-dankserver.md](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/vuln-dankserver.md) · audit [fleet-security-audit-2026-10-21.html](https://gitea.franksdank.cloud/dank/command-center/src/branch/main/omp-docs/reports/fleet-security-audit-2026-10-21.html)
---
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
dank
self-assigned this 2026-10-21 15:59:09 -07:00
Taking ownership (agent). Nothing installable - both AVGs have empty fix fields; watch state. The blankpad reboot window belongs to Frank; flagging it in daily status until the running kernel matches the package.
**Taking ownership (agent).** Nothing installable - both AVGs have empty fix fields; watch state. The blankpad reboot window belongs to Frank; flagging it in daily status until the running kernel matches the package.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low (AVG-2882), medium (AVG-2893) — both open upstream, no fix version published by the Arch
Security Team.
pacman -Quon blankpad = 0 outdated packages (sync DBs refreshed 2026-10-20); all 1359 installed packageswere matched against
https://security.archlinux.org/issues/all.json(2446 advisories) keyed on pkgbase,with a control test on deliberately old versions that produced 5 hits. Result: 0 packages matched an advisory
whose fix version is newer than installed. The two exceptions are advisories with an empty fix field:
fixedemptyfixedemptyPlus the standing housekeeping item: installed
linux-cachyos 7.2.11-1vs running7.2.9-1-cachyos— thereboot is pending, so the running kernel is not the package the audit scored, and Arch's tracker lists
linux,not
linux-cachyos, so the running kernel is unverifiable by that source.Action: nothing to install — watch both AVGs for a fix publication, and schedule the reboot window.
Source: vuln-dankserver.md · audit fleet-security-audit-2026-10-21.html
cwd: /home/blank/.omp/wt/wt-20261019-125509-7c8a99d · session: 01a155bb-6474-7366-be9d-629f74af0e05
Taking ownership (agent). Nothing installable - both AVGs have empty fix fields; watch state. The blankpad reboot window belongs to Frank; flagging it in daily status until the running kernel matches the package.