Frank
27da5cd9ec
Fold the Dankclaw and Dankserver vulnerability passes into
fleet-security-audit-2026-10-21.html: the stub "Advisory cross-reference (in
progress)" section becomes the full matrix (host advisories, GHSA coverage,
image-vulnerability matrix, no-advisory census, observed-without-credentials
rows for the two livingroom hosts) and the header links the two working files,
which move into omp-docs/reports/ with an index of their own.
Correct three figures the audit had wrong, all found by re-probing: the
mutable-tag census (17 -> 19 Dankclaw manifests / 17 unique references, +4 on
Dankserver), the Dankserver OpenSSH advisory count (0 -> 5 unpatched CVEs; the
first OSV query omitted the version epoch, and OSV answers "0 vulns" rather
than "unknown" for a malformed purl), and the Plex version ("12.1.0" is
Jellyfin's - the live container reports 1.43.5.11029-6bf8af3f0-ls329). Also
repair a malformed <code> tag in F1's evidence cell.
kb-lint and kb-coverage both report 0 issues; index.md gains the Reports
section and log.md the matching entry.
27 KiB
27 KiB
type, title, description, tags, verified
| type | title | description | tags | verified | ||||
|---|---|---|---|---|---|---|---|---|
| reference | Fleet vulnerability pass — Dankserver, blankpad, danklivingroom (2026-10-21) | Per-host CVE/GHSA pass for the Dankserver quadlet images and Ubuntu 26.04 host, the blankpad Arch package set, and the password-only danklivingroom box — the evidence base behind the fleet security audit report. |
|
2026-10-21 |
Fleet vulnerability pass — dankserver (+ blankpad, danklivingroom)
Generated 2026-10-21. Every row is grounded in a response actually fetched this run: OSV
POST https://api.osv.dev/v1/query, the Ubuntu Security Tracker JSON API, the Arch Security Team
tracker (https://security.archlinux.org/issues/all.json), GitHub repository advisories
(api.github.com/repos/<org>/<repo>/security-advisories), or openssh.com/security.html.
No CVE id, advisory id, or fixed version was written from memory. NEVER verified statements are
listed in ## Unverifiable with the exact command tried.
API calls this slice: 61 (18 OSV format probes, 25 OSV queries + 8 GitHub advisory lists in one script, 1 Arch tracker dump, 7 Ubuntu tracker lookups, 1 openssh.com page, 1 OSV list page).
dankserver
Host: Ubuntu 26.04.1 LTS (Resolute Raccoon), kernel 7.0.0-38-generic (linux-image-generic 7.0.0-38.38),
rootless Podman quadlets. Image list from
ssh dankserver 'grep -h "^Image=" ~/.config/containers/systemd/*.container | sort'.
Host packages (OSV ecosystem Ubuntu, purl pkg:deb/ubuntu/<src>@<ver>?arch=src&distro=ubuntu-26.04)
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110923 | medium (CVSS3 6.5; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) |
none published for 26.04 (tracker status needs-triage, no USN) |
https://ubuntu.com/security/CVE-2026-110923 |
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110924 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-110924 |
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110925 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-110925 |
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110926 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-110926 |
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110927 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-110927 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2025-5024 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H |
none published for 26.04 | https://ubuntu.com/security/CVE-2025-5024 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2026-109832 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-109832 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2026-109833 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-109833 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2026-18358 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-18358 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2026-96541 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-96541 |
| rpcbind | 1.2.7-1build2 | CVE-2026-16277 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-16277 |
| rpcbind | 1.2.7-1build2 | CVE-2026-16461 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-16461 |
| rpcbind | 1.2.7-1build2 | CVE-2026-94640 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
none published for 26.04 | https://ubuntu.com/security/CVE-2026-94640 |
| openssl / libssl3t64 | 3.5.5-1ubuntu3.7 | no OSV entry | — | — | https://api.osv.dev/v1/query (purl pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?arch=src&distro=ubuntu-26.04 → {}) |
| nfs-utils (nfs-kernel-server/nfs-common) | 1:2.8.5-1ubuntu1 | no OSV entry | — | — | https://api.osv.dev/v1/query (purl .../nfs-utils@1:2.8.5-1ubuntu1?distro=ubuntu-26.04 → {}) |
| samba (samba-libs) | 2:4.23.6+dfsg-1ubuntu2.2 | no OSV entry | — | — | https://api.osv.dev/v1/query (purl .../samba@2:4.23.6+dfsg-1ubuntu2.2?distro=ubuntu-26.04 → {}) |
| syncthing | 1.29.5~ds1-3 (binary v1.29.5 go1.25.0) |
no OSV entry affecting this version | — | — | https://api.osv.dev/v1/query — 3 records returned (CVE-2021-21404, CVE-2022-31129, CVE-2022-46165) but none lists 1.29.5~ds1-3 in the Ubuntu:26.04:LTS affected set; GitHub advisories for syncthing/syncthing (2) are both patched before 1.29.5 |
| linux kernel (host) | 7.0.0-38.38 | 35 records untriaged, not confirmed vulnerable — see Unverifiable | e.g. CVE-2013-7445 medium, CVE-2012-4542 low | no fix event for 26.04 in any of the 35 | https://ubuntu.com/security/CVE-2013-7445 (representative; full set in Unverifiable) |
apt-cache policy openssh-server on the host: Installed: 1:10.2p1-2ubuntu3.8 / Candidate: 1:10.2p1-2ubuntu3.8
— i.e. Ubuntu has not shipped a newer build, consistent with "no fix published". Tracker status for
CVE-2026-110923 read directly from https://ubuntu.com/security/cves/CVE-2026-110923.json:
release_codename=resolute → needs-triage, notices_ids=[], patches=[]. The other 12 rows above come
from the same OSV query: the Ubuntu:26.04:LTS affected entry lists the installed version and carries no
fixed event.
Containers (running version resolved first, then queried)
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| ghcr.io/jellyfin/jellyfin:latest | 12.1.0 (GET 127.0.0.1:8096/System/Info/Public → "Version":"12.1.0") |
none of 23 repository advisories apply | — | — | https://github.com/jellyfin/jellyfin/security/advisories (all patched ranges ≤ 12.0) |
lscr.io/linuxserver/plex (tag 1.43.5.11029-6bf8af3f0-ls329) |
1.43.5.11029 (podman exec plex cat /build_version) — not 12.1.0 |
no OSV entry; no vendor advisory feed | — | — | see Unverifiable (curl 127.0.0.1:32400/identity → empty reply) |
| ghcr.io/rommapp/romm:latest | 5.3.1 (podman exec romm cat /backend/__version__.py; image commit 95599dad, built 2026-09-23) |
none of 15 repository advisories apply | — | — | https://github.com/rommapp/romm/security/advisories |
| ghcr.io/9001/copyparty-ac:latest | 1.20.24 (image label org.opencontainers.image.version, container runs image 2284b21e4259) |
GHSA-3c88-p299-7hvr | medium | 1.20.25 | https://github.com/9001/copyparty/security/advisories/GHSA-3c88-p299-7hvr |
| ghcr.io/9001/copyparty-ac:latest | 1.20.24 | GHSA-hg99-jqfp-rf76 | low | 1.20.26 | https://github.com/9001/copyparty/security/advisories/GHSA-hg99-jqfp-rf76 |
| lscr.io/linuxserver/calibre:9.15.0 | 9.15.0 (tag) | no OSV entry | — | — | see Unverifiable |
| lscr.io/linuxserver/calibre-web:0.6.27-ls402 | 0.6.27 (tag) | no OSV entry (PyPI calibre-web @ 0.6.27) |
— | — | https://api.osv.dev/v1/query → {} |
| lscr.io/linuxserver/tautulli:v2.18.1-ls245 | 2.18.1 (tag) | none of 18 repository advisories apply | — | — | https://github.com/Tautulli/Tautulli/security/advisories (all patched ≤ 2.17.2) |
| library/redis:7-alpine (Alpine 3.21.7 base) | 7.4.11 (podman exec romm-redis redis-server --version) |
CVE-2026-23479 | high | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3 |
| library/redis:7-alpine | 7.4.11 | CVE-2026-25243 | high | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4 |
| library/redis:7-alpine | 7.4.11 | CVE-2025-46817 | high | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp |
| library/redis:7-alpine | 7.4.11 | CVE-2025-48367 | high | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq |
| library/redis:7-alpine | 7.4.11 | CVE-2025-32023 | high | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43 |
| library/redis:7-alpine | 7.4.11 | CVE-2025-21605 | high | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff |
| library/redis:7-alpine | 7.4.11 | GHSA-2r7g-8hpc-rpq9 (no CVE assigned) | high | none | https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9 |
| library/redis:7-alpine | 7.4.11 | CVE-2026-23631 | medium | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826 |
| library/redis:7-alpine | 7.4.11 | CVE-2024-51741 | medium | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9 |
| library/redis:7-alpine | 7.4.11 | CVE-2025-27151 | medium | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm |
| library/redis:7-alpine | 7.4.11 | CVE-2025-46818 | medium | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp |
| library/redis:7-alpine | 7.4.11 | CVE-2025-46819 | medium | vendor lists TBD |
https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f |
| library/redis:7-alpine | 7.4.11 | CVE-2025-49844 (critical) — not affected, fixed at 7.4.6 | critical | 7.4.6 (installed 7.4.11) | https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q |
| library/mariadb:11 | 11.8.9 (podman exec romm-mariadb mariadb --version) |
no OSV ecosystem for upstream MariaDB | — | — | see Unverifiable |
| docker.io/prom/node-exporter:latest | 1.12.1 (node_exporter_build_info metric, :9100/metrics) |
no OSV entry (Go github.com/prometheus/node_exporter v1.12.1); 0 repository advisories |
— | — | https://api.osv.dev/v1/query → {}; https://github.com/prometheus/node_exporter/security/advisories |
| gcr.io/cadvisor/cadvisor:v0.49.1 | v0.49.1 (image built 2024-03-02) | no OSV entry (Go github.com/google/cadvisor v0.49.1) |
— | — | https://api.osv.dev/v1/query → {} |
| localhost/radiance-vllm:0.13.0-e060895 (not running; basis vllm 0.13.0) | 0.13.0 | GHSA-4r2x-xpjr-7cvv | CRITICAL | 0.14.1 | https://github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvv |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-94f4-hr76-p5j6 | CRITICAL | 0.22.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6 |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-2pc9-4j83-qjmr | HIGH | 0.14.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-qh4c-xf7m-gxfc | HIGH | 0.14.1 | https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-7972-pg2x-xr59 | HIGH | 0.18.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59 |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-wcwg-c5fc-9vrc (CVE-2026-5497) | HIGH | 0.19.0 | https://nvd.nist.gov/vuln/detail/CVE-2026-5497 |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-q8gq-377p-jq3r | HIGH | 0.22.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-33cg-gxv8-3p8g, GHSA-rwxx-mrjm-wc2m | HIGH (2) | 0.24.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-33cg-gxv8-3p8g |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | 41 further advisories (23 moderate, 2 low, 16 unlabelled) — deduplicated across GHSA/PYSEC/Red Hat sources | moderate/low/unlabelled | earliest fix branch 0.14.0, latest 0.32.0 | https://api.osv.dev/v1/query ({"package":{"name":"vllm","ecosystem":"PyPI"},"version":"0.13.0"} → 84 records, 50 unique advisories) |
The radiance-vllm tag is a locally built image (podman images: image id 012d39ede956,
created 2026-09-22, also tagged docker.io/ggz14/vllm-radiance-mxfp4:0.13.0-e060895); its only
label metadata is org.opencontainers.image.version=24.04 (the Ubuntu 24.04 base). The
0.13.0 reading of the tag is the vllm version the fork is built on — the running frank-archon
container is a different image (docker.io/stilldeadcode/radiance@sha256:d590e300… = radiance:1.8.1),
and python3 is not present in that image to confirm an embedded vllm version.
blankpad
CachyOS (Arch) x86_64, uname -r = 7.2.9-1-cachyos, installed kernel package
linux-cachyos 7.2.11-1 (reboot pending). pacman -Qu = 0 outdated packages; sync DBs last
refreshed 2026-10-20. Tracker dump fetched 2026-10-21 13:02.
OSV cannot answer Arch queries: POST https://api.osv.dev/v1/query with
{"package":{"name":"openssh","ecosystem":"Arch Linux"},"version":"10.6p1-2.1"} returns
{"code":3,"message":"invalid ecosystem"} (same for Arch, archlinux, Archlinux, ArchLinux,
and for the purl form pkg:arch/openssh@10.6p1-2.1?arch=x86_64&distro=arch-any). Vendor tracker used
instead: Arch Security Team, https://security.archlinux.org/issues/all.json (2446 advisories),
matched against all 1359 installed packages keyed on pkgbase (so systemd-libs, vim-runtime,
python-* etc. are covered, not just same-named binaries). Matcher control test with deliberately old
versions (systemd-libs 250.0-1, vim-runtime 9.0.1224-1, curl 8.1.2-1) produced 5 hits, so the
matcher is not vacuous.
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| openssh | 10.6p1-2.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ (0 open advisories for openssh) |
| openssl | 3.6.5-1.1 | no fixed-version advisory; AVG-2882 (CVE-2025-4575) is open upstream | low (AVG-2882) | unfixed (fixed empty; affected baseline 3.5.0-1) |
https://security.archlinux.org/AVG-2882 |
| sudo | 1.9.17.p2-6.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ (0 open advisories for sudo) |
| systemd | 262.1-1 | no fixed-version advisory; AVG-2893 (CVE-2025-4598) is open upstream | medium (AVG-2893) | unfixed (fixed empty; affected baseline 257.6-1) |
https://security.archlinux.org/AVG-2893 |
| curl | 8.23.0-1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| wget | 1.25.0-6.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| git | 2.56.0-1.1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| firefox | 158.0.1-1.1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| podman | 6.1.4-1.1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| python | 3.14.8-1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| nodejs | 26.11.1-2 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| zsh | 5.9.2-1.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| bash | 5.3.20-2 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| vim | 9.2.1178-1.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| neovim | 0.12.6-1.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| mesa / vulkan-radeon / lib32-mesa / lib32-vulkan-radeon | 3:26.2.4-1 (all four) | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| xf86-video-amdgpu | 25.0.0-1.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| nvidia driver packages | not installed (pacman -Q nvidia nvidia-utils → "package … was not found") |
n/a | — | — | pacman -Q on blankpad |
| nginx | not installed | n/a | — | — | pacman -Q nginx → not found |
| caddy | not installed | n/a | — | — | pacman -Q caddy → not found |
| docker | not installed | n/a | — | — | pacman -Q docker → not found |
| rust / golang | not installed (rust, rust-std, rustup, go, golang all absent) |
n/a | — | — | pacman -Q on blankpad |
| gnutls / glib2 / glibc / binutils / util-linux / pacman (extra coverage) | 3.8.13-3.1 / 2.90.1-1.1 / 2.44+r50+g1848099f063e-3 / 2.47-2 / 2.42.4-1.1 / 7.1.0.r9.g54d9411-5 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| linux-cachyos (kernel) | installed 7.2.11-1, running 7.2.9-1-cachyos | not assessable — see Unverifiable | — | — | https://security.archlinux.org/ (tracker lists linux, not linux-cachyos) |
Full-system result: 0 of 1359 installed packages matched an Arch advisory whose fix version is newer
than the installed version. The two rows above (AVG-2882, AVG-2893) are advisories the tracker still
carries as unfixed; their affected baselines (3.5.0-1, 257.6-1) predate what is installed, and Arch
publishes no per-version statement, so exposure is unresolved rather than confirmed either way.
danklivingroom
Verified probe (2026-10-21): ssh -o BatchMode=yes dank@192.168.0.40 'uname -a' →
dank@192.168.0.40: Permission denied (publickey,password). — password auth only, so the OS release and
package inventory are unknown. The address pair 192.168.0.40 / 192.168.0.215 answers as the same box
(banner reported as OpenSSH 10.0); only upstream OpenSSH 10.0p1 advisories were queried.
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| OpenSSH (danklivingroom) | 10.0p1 (ssh banner; OS unknown) | vendor tracker lists no advisory for 10.0p1 | — | — | https://www.openssh.com/security.html (7 advisories listed; newest CVE-2025-26465 covers 9.5p1–9.9p1 and was fixed in 10.0p1) |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2025-61984 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
Ubuntu fix for the 10.0p1 source line: 1:10.0p1-5ubuntu5.1 (USN-8090-1) | https://ubuntu.com/security/CVE-2025-61984 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2025-61985 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
1:10.0p1-5ubuntu5.1 (USN-8090-1) | https://ubuntu.com/security/CVE-2025-61985 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-3497 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L |
1:10.0p1-5ubuntu5.1 (USN-8090-1) | https://ubuntu.com/security/CVE-2026-3497 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35385 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35385 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35386 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35386 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35387 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35387 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35388 | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N |
1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35388 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35414 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35414 |
| OpenSSH (danklivingroom) | 10.0p1 | everything else (all OS/distro inventory) | unverified | — | see Unverifiable |
Method note: these 7 CVEs are the records from the OSV name/version query
({"package":{"name":"openssh"},"version":"10.0p1"}) whose fixed-version set contains a build of the
10.0p1 source package itself (1:10.0p1-5ubuntu5.1, 1:10.0p1-5ubuntu5.4) — i.e. the vendor patched
10.0p1 after release, so plain 10.0p1 is affected. The query returned 379 records in total; the other
372 are cross-distro notices (Debian DSA/DLA, SUSE, Mageia, Root-OS, ECHO, TuxCare, USNs for unrelated
release series) whose fix versions belong to other package lines and therefore say nothing about 10.0p1.
Ten further advisories fixed OpenSSH in the 10.0.x line (10.0p2-160000.3.1/6.1/7.1, 10.0p2-2.1,
10.0p1-4.1.mga10) are notice-level records with no CVE alias in the payload, so they are not listed as
rows: https://bugzilla.suse.com/1251198, https://bugzilla.suse.com/1259642, https://bugzilla.suse.com/1271044,
https://advisories.mageia.org/MGASA-2026-0521.html.
Pinning gaps
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
ghcr.io/9001/copyparty-ac:latest (image 2284b21e4259, built 2026-09-19) |
1.20.24 | GHSA-3c88-p299-7hvr + GHSA-hg99-jqfp-rf76 | medium + low | 1.20.25 / 1.20.26 | https://github.com/9001/copyparty/security/advisories/GHSA-3c88-p299-7hvr |
ghcr.io/jellyfin/jellyfin:latest (image 6370ab0005b4, built 2026-09-15) |
12.1.0 | none affecting; tag floats, no digest pin | — | — | podman image inspect ghcr.io/jellyfin/jellyfin:latest |
ghcr.io/rommapp/romm:latest (image eab97d88d9d7, commit 95599dad, built 2026-09-23) |
5.3.1 | none affecting; commit build with no version label (org.opencontainers.image.version empty) |
— | — | podman image inspect ghcr.io/rommapp/romm:latest |
docker.io/prom/node-exporter:latest (image 9bbbca8f5cb8, built 2026-07-14) |
1.12.1 | none affecting; 3-month-old latest on disk |
— | — | podman images docker.io/prom/node-exporter |
| docker.io/library/mariadb:11 / library/redis:7-alpine | 11.8.9 (image built 2026-09-16) / 7.4.11 (image built 2026-08-18) | rolling tags; redis 7.4.11 carries 12 unresolved vendor advisories | up to high | see container table | https://github.com/redis/redis/security/advisories |
| gcr.io/cadvisor/cadvisor:v0.49.1 | v0.49.1, image built 2024-03-02 | no OSV entry, but the pin is 2.5 years old | — | — | podman image inspect gcr.io/cadvisor/cadvisor:v0.49.1 --format {{.Created}} |
quadlet Image=localhost/radiance-vllm:0.13.0-e060895 vs running container |
quadlet names a locally built image (id 012d39ede956, 2026-09-22); frank-archon actually runs docker.io/stilldeadcode/radiance@sha256:d590e300… (radiance:1.8.1) |
n/a (provenance, not a CVE) | — | — | podman ps --format '{{.Names}} {{.Image}}'; podman images |
lscr.io/linuxserver/plex (pinned tag) + lscr.io/linuxserver/plex:latest also on disk (b9f135c281ce, 4 weeks) |
1.43.5.11029-6bf8af3f0-ls329 | n/a | — | — | podman images on dankserver |
| stale local images retained on disk | ghcr.io/everywall/ladder:latest (2 years), docker.io/ta264/docker-calibre:latest (3 years), localhost/radiance-vllm:0.9.3 |
n/a — attack surface / rollback trap | — | — | podman images on dankserver |
| Ubuntu 26.04 staged updates not applied | 12 systemd-family packages (systemd, libsystemd0, libpam-systemd, libnss-systemd, libsystemd-shared, libudev1, udev, systemd-resolved, systemd-timesyncd, systemd-oomd, systemd-cryptsetup, systemd-sysv) 259.5-0ubuntu3.4 → 259.9-0ubuntu0.1, and xserver-xorg-core/xserver-common/xserver-xorg-dev 2:21.1.22-1ubuntu1.2 → 2:21.1.22-1ubuntu1.3 — all offered from resolute-updates but held back (apt-get -s upgrade → 0 upgraded, 0 newly installed, 0 to remove and 15 not upgraded) |
not CVE-attributed this run | — | — | ssh dankserver 'apt list --upgradable' |
| blankpad kernel | running 7.2.9-1-cachyos while linux-cachyos 7.2.11-1 is installed (reboot pending) |
unassessed (kernel not in Arch tracker) | — | — | uname -r vs pacman -Q linux-cachyos |
| blankpad foreign packages outside any sync DB | handy-bin, herdr-bin, nirimod-git, typora |
no tracker coverage | — | — | pacman -Qii vs /var/lib/pacman/sync/*.db |
Unverifiable
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| lscr.io/linuxserver/plex (running build) | tag/label says 1.43.5.11029-6bf8af3f0-ls329; runtime version unconfirmed | no OSV entry (plex-media-server @ 1.43.5.11029 → {}); no Plex advisory feed consulted (none public) |
— | — | curl -s 127.0.0.1:32400/identity → "Empty reply from server"; version taken from podman exec plex cat /build_version |
| library/mariadb:11 (11.8.9) | 11.8.9 (podman exec romm-mariadb mariadb --version) |
upstream MariaDB has no OSV ecosystem; name-only query returns 310 cross-distro records (Debian/Ubuntu/Alpine builds) that cannot be attributed to this image | — | — | curl -X POST https://api.osv.dev/v1/query -d '{"package":{"name":"mariadb"},"version":"11.8.9"}' |
| lscr.io/linuxserver/calibre (9.15.0) | 9.15.0 | name-only OSV query returns 26 cross-distro records, none attributable; no Calibre advisory feed checked | — | — | curl -X POST https://api.osv.dev/v1/query -d '{"package":{"name":"calibre"},"version":"9.15.0"}' |
| linux kernel on dankserver (7.0.0-38.38) | 7.0.0-38.38 | 35 OSV records list the installed kernel in the Ubuntu:26.04:LTS affected set with no fixed event (e.g. CVE-2012-4542 low, CVE-2013-7445 medium, CVE-2015-7837, CVE-2016-8660, CVE-2020-26140, …). Ubuntu's own per-release status for such records is needs-triage/ignored, so these are untriaged, not confirmed vulnerable; per-CVE verification exceeded the call cap |
mixed (low/medium, untriaged) | none published for 26.04 in these records | verify one row with: curl -s https://ubuntu.com/security/cves/CVE-2013-7445.json and read packages[].statuses[] for release_codename=resolute |
| redis 7.4.11 "unpatched upstream" rows | 7.4.11 | the redis/redis advisories above carry patched_versions: TBD, while downstream trackers in the same OSV response show fix levels at 8.0.4 / 7.0.15-rX — whether the 7.4 branch received these fixes is not stated by the vendor |
high/medium | unresolved | https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp |
blankpad kernel (linux-cachyos) |
installed 7.2.11-1, running 7.2.9-1-cachyos | Arch tracker has no linux-cachyos entry (its 683 package names include linux and linux-lts only), so a CachyOS-built kernel cannot be assessed by name. Three linux advisories are still open upstream — AVG-1879 (CVE-2021-43976 etc., medium), AVG-2345 (CVE-2021-31615 etc., medium), AVG-1594 (CVE-2020-35501, low) — all baselined at 5.15.8.arch1-1 |
unresolved | — | https://security.archlinux.org/AVG-1879, https://security.archlinux.org/AVG-2345, https://security.archlinux.org/AVG-1594 |
| danklivingroom OS + package inventory | unknown (OS unknown) |
password-auth-only host; every non-OpenSSH component (OS release, container runtime, media stack) unassessed | — | — | ssh -o BatchMode=yes dank@192.168.0.40 'uname -a' → Permission denied (publickey,password).; raw banner read on 192.168.0.215:22 timed out (/dev/tcp probe), so 10.0 is the reported banner version, not one I captured |
| localhost/radiance-vllm:0.13.0-e060895 embedded vllm version | tag-derived 0.13.0 only; the image's only labels are org.opencontainers.image.ref.name=ubuntu / org.opencontainers.image.version=24.04 (base image metadata, image 012d39ede956 built 2026-09-22), and the running frank-archon container has no python to confirm |
50 advisories assessed against 0.13.0 — if the fork carries a different vllm base, that whole row set changes | — | — | podman image inspect localhost/radiance-vllm:0.13.0-e060895 --format '{{json .Config.Labels}}'; podman exec frank-archon python3 -c "import vllm" → exec: "python3": executable file not found in $PATH |