dank/command-center
1
0 Fork 0
Code Issues 11 Pull Requests 1 Actions Packages Projects Releases Wiki Activity
Files
f1402ca89c9337c4b014959847c36362e455a533
command-center/omp-docs/reports/vuln-dankserver.md
T
Frank 27da5cd9ec docs(reports): land the fleet security audit with its per-host vuln passes 
Fold the Dankclaw and Dankserver vulnerability passes into
fleet-security-audit-2026-10-21.html: the stub "Advisory cross-reference (in
progress)" section becomes the full matrix (host advisories, GHSA coverage,
image-vulnerability matrix, no-advisory census, observed-without-credentials
rows for the two livingroom hosts) and the header links the two working files,
which move into omp-docs/reports/ with an index of their own.

Correct three figures the audit had wrong, all found by re-probing: the
mutable-tag census (17 -> 19 Dankclaw manifests / 17 unique references, +4 on
Dankserver), the Dankserver OpenSSH advisory count (0 -> 5 unpatched CVEs; the
first OSV query omitted the version epoch, and OSV answers "0 vulns" rather
than "unknown" for a malformed purl), and the Plex version ("12.1.0" is
Jellyfin's - the live container reports 1.43.5.11029-6bf8af3f0-ls329). Also
repair a malformed <code> tag in F1's evidence cell.

kb-lint and kb-coverage both report 0 issues; index.md gains the Reports
section and log.md the matching entry.
2026-10-21 14:04:33 -07:00

213 lines
27 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
---
type: reference
title: Fleet vulnerability pass — Dankserver, blankpad, danklivingroom (2026-10-21)
description: Per-host CVE/GHSA pass for the Dankserver quadlet images and Ubuntu 26.04 host, the blankpad Arch package set, and the password-only danklivingroom box — the evidence base behind the fleet security audit report.
tags:
- security
- vulnerability
- dankserver
- blankpad
verified: 2026-10-21
---
# Fleet vulnerability pass — dankserver (+ blankpad, danklivingroom)
Generated 2026-10-21. Every row is grounded in a response actually fetched this run: OSV
`POST https://api.osv.dev/v1/query`, the Ubuntu Security Tracker JSON API, the Arch Security Team
tracker (`https://security.archlinux.org/issues/all.json`), GitHub repository advisories
(`api.github.com/repos/<org>/<repo>/security-advisories`), or `openssh.com/security.html`.
No CVE id, advisory id, or fixed version was written from memory. `NEVER verified` statements are
listed in `## Unverifiable` with the exact command tried.
API calls this slice: 61 (18 OSV format probes, 25 OSV queries + 8 GitHub advisory lists in one
script, 1 Arch tracker dump, 7 Ubuntu tracker lookups, 1 openssh.com page, 1 OSV list page).
## dankserver
Host: Ubuntu 26.04.1 LTS (Resolute Raccoon), kernel `7.0.0-38-generic` (`linux-image-generic 7.0.0-38.38`),
rootless Podman quadlets. Image list from
`ssh dankserver 'grep -h "^Image=" ~/.config/containers/systemd/*.container | sort'`.
### Host packages (OSV ecosystem `Ubuntu`, purl `pkg:deb/ubuntu/<src>@<ver>?arch=src&distro=ubuntu-26.04`)
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110923 | medium (CVSS3 6.5; `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`) | none published for 26.04 (tracker status `needs-triage`, no USN) | https://ubuntu.com/security/CVE-2026-110923 |
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110924 | `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-110924 |
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110925 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-110925 |
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110926 | `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-110926 |
| openssh (host) | 1:10.2p1-2ubuntu3.8 | CVE-2026-110927 | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-110927 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2025-5024 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H` | none published for 26.04 | https://ubuntu.com/security/CVE-2025-5024 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2026-109832 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-109832 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2026-109833 | `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-109833 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2026-18358 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-18358 |
| gnome-remote-desktop | 50.2-0ubuntu0.1 | CVE-2026-96541 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-96541 |
| rpcbind | 1.2.7-1build2 | CVE-2026-16277 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-16277 |
| rpcbind | 1.2.7-1build2 | CVE-2026-16461 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-16461 |
| rpcbind | 1.2.7-1build2 | CVE-2026-94640 | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` | none published for 26.04 | https://ubuntu.com/security/CVE-2026-94640 |
| openssl / libssl3t64 | 3.5.5-1ubuntu3.7 | no OSV entry | — | — | https://api.osv.dev/v1/query (purl `pkg:deb/ubuntu/openssl@3.5.5-1ubuntu3.7?arch=src&distro=ubuntu-26.04` → `{}`) |
| nfs-utils (nfs-kernel-server/nfs-common) | 1:2.8.5-1ubuntu1 | no OSV entry | — | — | https://api.osv.dev/v1/query (purl `.../nfs-utils@1:2.8.5-1ubuntu1?distro=ubuntu-26.04` → `{}`) |
| samba (samba-libs) | 2:4.23.6+dfsg-1ubuntu2.2 | no OSV entry | — | — | https://api.osv.dev/v1/query (purl `.../samba@2:4.23.6+dfsg-1ubuntu2.2?distro=ubuntu-26.04` → `{}`) |
| syncthing | 1.29.5~ds1-3 (binary `v1.29.5` go1.25.0) | no OSV entry affecting this version | — | — | https://api.osv.dev/v1/query — 3 records returned (CVE-2021-21404, CVE-2022-31129, CVE-2022-46165) but none lists `1.29.5~ds1-3` in the `Ubuntu:26.04:LTS` affected set; GitHub advisories for `syncthing/syncthing` (2) are both patched before 1.29.5 |
| linux kernel (host) | 7.0.0-38.38 | 35 records untriaged, not confirmed vulnerable — see Unverifiable | e.g. CVE-2013-7445 medium, CVE-2012-4542 low | no fix event for 26.04 in any of the 35 | https://ubuntu.com/security/CVE-2013-7445 (representative; full set in Unverifiable) |
`apt-cache policy openssh-server` on the host: `Installed: 1:10.2p1-2ubuntu3.8 / Candidate: 1:10.2p1-2ubuntu3.8`
— i.e. Ubuntu has not shipped a newer build, consistent with "no fix published". Tracker status for
CVE-2026-110923 read directly from `https://ubuntu.com/security/cves/CVE-2026-110923.json`:
`release_codename=resolute → needs-triage`, `notices_ids=[]`, `patches=[]`. The other 12 rows above come
from the same OSV query: the `Ubuntu:26.04:LTS` affected entry lists the installed version and carries no
`fixed` event.
### Containers (running version resolved first, then queried)
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| ghcr.io/jellyfin/jellyfin:latest | 12.1.0 (`GET 127.0.0.1:8096/System/Info/Public` → `"Version":"12.1.0"`) | none of 23 repository advisories apply | — | — | https://github.com/jellyfin/jellyfin/security/advisories (all patched ranges ≤ 12.0) |
| lscr.io/linuxserver/plex (tag `1.43.5.11029-6bf8af3f0-ls329`) | 1.43.5.11029 (`podman exec plex cat /build_version`) — **not** 12.1.0 | no OSV entry; no vendor advisory feed | — | — | see Unverifiable (`curl 127.0.0.1:32400/identity` → empty reply) |
| ghcr.io/rommapp/romm:latest | 5.3.1 (`podman exec romm cat /backend/__version__.py`; image commit 95599dad, built 2026-09-23) | none of 15 repository advisories apply | — | — | https://github.com/rommapp/romm/security/advisories |
| ghcr.io/9001/copyparty-ac:latest | 1.20.24 (image label `org.opencontainers.image.version`, container runs image `2284b21e4259`) | GHSA-3c88-p299-7hvr | medium | 1.20.25 | https://github.com/9001/copyparty/security/advisories/GHSA-3c88-p299-7hvr |
| ghcr.io/9001/copyparty-ac:latest | 1.20.24 | GHSA-hg99-jqfp-rf76 | low | 1.20.26 | https://github.com/9001/copyparty/security/advisories/GHSA-hg99-jqfp-rf76 |
| lscr.io/linuxserver/calibre:9.15.0 | 9.15.0 (tag) | no OSV entry | — | — | see Unverifiable |
| lscr.io/linuxserver/calibre-web:0.6.27-ls402 | 0.6.27 (tag) | no OSV entry (PyPI `calibre-web` @ 0.6.27) | — | — | https://api.osv.dev/v1/query → `{}` |
| lscr.io/linuxserver/tautulli:v2.18.1-ls245 | 2.18.1 (tag) | none of 18 repository advisories apply | — | — | https://github.com/Tautulli/Tautulli/security/advisories (all patched ≤ 2.17.2) |
| library/redis:7-alpine (Alpine 3.21.7 base) | 7.4.11 (`podman exec romm-redis redis-server --version`) | CVE-2026-23479 | high | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-93m2-935m-8rj3 |
| library/redis:7-alpine | 7.4.11 | CVE-2026-25243 | high | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4 |
| library/redis:7-alpine | 7.4.11 | CVE-2025-46817 | high | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp |
| library/redis:7-alpine | 7.4.11 | CVE-2025-48367 | high | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-4q32-c38c-pwgq |
| library/redis:7-alpine | 7.4.11 | CVE-2025-32023 | high | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-rp2m-q4j6-gr43 |
| library/redis:7-alpine | 7.4.11 | CVE-2025-21605 | high | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-r67f-p999-2gff |
| library/redis:7-alpine | 7.4.11 | GHSA-2r7g-8hpc-rpq9 (no CVE assigned) | high | none | https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9 |
| library/redis:7-alpine | 7.4.11 | CVE-2026-23631 | medium | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826 |
| library/redis:7-alpine | 7.4.11 | CVE-2024-51741 | medium | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-prpq-rh5h-46g9 |
| library/redis:7-alpine | 7.4.11 | CVE-2025-27151 | medium | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-5453-q98w-cmvm |
| library/redis:7-alpine | 7.4.11 | CVE-2025-46818 | medium | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-qrv7-wcrx-q5jp |
| library/redis:7-alpine | 7.4.11 | CVE-2025-46819 | medium | vendor lists `TBD` | https://github.com/redis/redis/security/advisories/GHSA-4c68-q8q8-3g4f |
| library/redis:7-alpine | 7.4.11 | CVE-2025-49844 (critical) — **not affected**, fixed at 7.4.6 | critical | 7.4.6 (installed 7.4.11) | https://github.com/redis/redis/security/advisories/GHSA-4789-qfc9-5f9q |
| library/mariadb:11 | 11.8.9 (`podman exec romm-mariadb mariadb --version`) | no OSV ecosystem for upstream MariaDB | — | — | see Unverifiable |
| docker.io/prom/node-exporter:latest | 1.12.1 (`node_exporter_build_info` metric, `:9100/metrics`) | no OSV entry (Go `github.com/prometheus/node_exporter` v1.12.1); 0 repository advisories | — | — | https://api.osv.dev/v1/query → `{}`; https://github.com/prometheus/node_exporter/security/advisories |
| gcr.io/cadvisor/cadvisor:v0.49.1 | v0.49.1 (image built 2024-03-02) | no OSV entry (Go `github.com/google/cadvisor` v0.49.1) | — | — | https://api.osv.dev/v1/query → `{}` |
| localhost/radiance-vllm:0.13.0-e060895 (not running; basis vllm 0.13.0) | 0.13.0 | GHSA-4r2x-xpjr-7cvv | CRITICAL | 0.14.1 | https://github.com/vllm-project/vllm/security/advisories/GHSA-4r2x-xpjr-7cvv |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-94f4-hr76-p5j6 | CRITICAL | 0.22.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6 |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-2pc9-4j83-qjmr | HIGH | 0.14.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-2pc9-4j83-qjmr |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-qh4c-xf7m-gxfc | HIGH | 0.14.1 | https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-7972-pg2x-xr59 | HIGH | 0.18.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59 |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-wcwg-c5fc-9vrc (CVE-2026-5497) | HIGH | 0.19.0 | https://nvd.nist.gov/vuln/detail/CVE-2026-5497 |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-q8gq-377p-jq3r | HIGH | 0.22.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-q8gq-377p-jq3r |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | GHSA-33cg-gxv8-3p8g, GHSA-rwxx-mrjm-wc2m | HIGH (2) | 0.24.0 | https://github.com/vllm-project/vllm/security/advisories/GHSA-33cg-gxv8-3p8g |
| localhost/radiance-vllm:0.13.0-e060895 | 0.13.0 | 41 further advisories (23 moderate, 2 low, 16 unlabelled) — deduplicated across GHSA/PYSEC/Red Hat sources | moderate/low/unlabelled | earliest fix branch 0.14.0, latest 0.32.0 | https://api.osv.dev/v1/query (`{"package":{"name":"vllm","ecosystem":"PyPI"},"version":"0.13.0"}` → 84 records, 50 unique advisories) |
The `radiance-vllm` tag is a locally built image (`podman images`: image id `012d39ede956`,
created 2026-09-22, also tagged `docker.io/ggz14/vllm-radiance-mxfp4:0.13.0-e060895`); its only
label metadata is `org.opencontainers.image.version=24.04` (the Ubuntu 24.04 base). The
`0.13.0` reading of the tag is the vllm version the fork is built on — the running `frank-archon`
container is a different image (`docker.io/stilldeadcode/radiance@sha256:d590e300…` = `radiance:1.8.1`),
and `python3` is not present in that image to confirm an embedded vllm version.
## blankpad
CachyOS (Arch) x86_64, `uname -r` = `7.2.9-1-cachyos`, installed kernel package
`linux-cachyos 7.2.11-1` (reboot pending). `pacman -Qu` = 0 outdated packages; sync DBs last
refreshed 2026-10-20. Tracker dump fetched 2026-10-21 13:02.
OSV cannot answer Arch queries: `POST https://api.osv.dev/v1/query` with
`{"package":{"name":"openssh","ecosystem":"Arch Linux"},"version":"10.6p1-2.1"}` returns
`{"code":3,"message":"invalid ecosystem"}` (same for `Arch`, `archlinux`, `Archlinux`, `ArchLinux`,
and for the purl form `pkg:arch/openssh@10.6p1-2.1?arch=x86_64&distro=arch-any`). Vendor tracker used
instead: Arch Security Team, `https://security.archlinux.org/issues/all.json` (2446 advisories),
matched against all 1359 installed packages keyed on **pkgbase** (so `systemd-libs`, `vim-runtime`,
`python-*` etc. are covered, not just same-named binaries). Matcher control test with deliberately old
versions (`systemd-libs 250.0-1`, `vim-runtime 9.0.1224-1`, `curl 8.1.2-1`) produced 5 hits, so the
matcher is not vacuous.
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| openssh | 10.6p1-2.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ (0 open advisories for `openssh`) |
| openssl | 3.6.5-1.1 | no fixed-version advisory; AVG-2882 (CVE-2025-4575) is open upstream | low (AVG-2882) | unfixed (`fixed` empty; affected baseline 3.5.0-1) | https://security.archlinux.org/AVG-2882 |
| sudo | 1.9.17.p2-6.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ (0 open advisories for `sudo`) |
| systemd | 262.1-1 | no fixed-version advisory; AVG-2893 (CVE-2025-4598) is open upstream | medium (AVG-2893) | unfixed (`fixed` empty; affected baseline 257.6-1) | https://security.archlinux.org/AVG-2893 |
| curl | 8.23.0-1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| wget | 1.25.0-6.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| git | 2.56.0-1.1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| firefox | 158.0.1-1.1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| podman | 6.1.4-1.1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| python | 3.14.8-1 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| nodejs | 26.11.1-2 | no OSV entry / no Arch advisory (0 open) | — | — | https://security.archlinux.org/ |
| zsh | 5.9.2-1.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| bash | 5.3.20-2 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| vim | 9.2.1178-1.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| neovim | 0.12.6-1.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| mesa / vulkan-radeon / lib32-mesa / lib32-vulkan-radeon | 3:26.2.4-1 (all four) | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| xf86-video-amdgpu | 25.0.0-1.1 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| nvidia driver packages | not installed (`pacman -Q nvidia nvidia-utils` → "package … was not found") | n/a | — | — | `pacman -Q` on blankpad |
| nginx | not installed | n/a | — | — | `pacman -Q nginx` → not found |
| caddy | not installed | n/a | — | — | `pacman -Q caddy` → not found |
| docker | not installed | n/a | — | — | `pacman -Q docker` → not found |
| rust / golang | not installed (`rust`, `rust-std`, `rustup`, `go`, `golang` all absent) | n/a | — | — | `pacman -Q` on blankpad |
| gnutls / glib2 / glibc / binutils / util-linux / pacman (extra coverage) | 3.8.13-3.1 / 2.90.1-1.1 / 2.44+r50+g1848099f063e-3 / 2.47-2 / 2.42.4-1.1 / 7.1.0.r9.g54d9411-5 | no OSV entry / no Arch advisory | — | — | https://security.archlinux.org/ |
| linux-cachyos (kernel) | installed 7.2.11-1, running 7.2.9-1-cachyos | not assessable — see Unverifiable | — | — | https://security.archlinux.org/ (tracker lists `linux`, not `linux-cachyos`) |
Full-system result: **0 of 1359 installed packages matched an Arch advisory whose fix version is newer
than the installed version.** The two rows above (AVG-2882, AVG-2893) are advisories the tracker still
carries as unfixed; their `affected` baselines (3.5.0-1, 257.6-1) predate what is installed, and Arch
publishes no per-version statement, so exposure is unresolved rather than confirmed either way.
## danklivingroom
Verified probe (2026-10-21): `ssh -o BatchMode=yes dank@192.168.0.40 'uname -a'` →
`dank@192.168.0.40: Permission denied (publickey,password).` — password auth only, so the OS release and
package inventory are `unknown`. The address pair 192.168.0.40 / 192.168.0.215 answers as the same box
(banner reported as OpenSSH 10.0); only upstream OpenSSH 10.0p1 advisories were queried.
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| OpenSSH (danklivingroom) | 10.0p1 (ssh banner; OS unknown) | vendor tracker lists no advisory for 10.0p1 | — | — | https://www.openssh.com/security.html (7 advisories listed; newest CVE-2025-26465 covers 9.5p1–9.9p1 and was fixed in 10.0p1) |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2025-61984 | `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N` | Ubuntu fix for the 10.0p1 source line: 1:10.0p1-5ubuntu5.1 (USN-8090-1) | https://ubuntu.com/security/CVE-2025-61984 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2025-61985 | `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N` | 1:10.0p1-5ubuntu5.1 (USN-8090-1) | https://ubuntu.com/security/CVE-2025-61985 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-3497 | `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L` | 1:10.0p1-5ubuntu5.1 (USN-8090-1) | https://ubuntu.com/security/CVE-2026-3497 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35385 | `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H` | 1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35385 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35386 | `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N` | 1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35386 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35387 | `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N` | 1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35387 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35388 | `CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N` | 1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35388 |
| OpenSSH (danklivingroom) | 10.0p1 | CVE-2026-35414 | `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N` | 1:10.0p1-5ubuntu5.4 (USN-8222-1) | https://ubuntu.com/security/CVE-2026-35414 |
| OpenSSH (danklivingroom) | 10.0p1 | everything else (all OS/distro inventory) | unverified | — | see Unverifiable |
Method note: these 7 CVEs are the records from the OSV name/version query
(`{"package":{"name":"openssh"},"version":"10.0p1"}`) whose fixed-version set contains a build of the
**10.0p1 source package itself** (`1:10.0p1-5ubuntu5.1`, `1:10.0p1-5ubuntu5.4`) — i.e. the vendor patched
10.0p1 after release, so plain 10.0p1 is affected. The query returned 379 records in total; the other
372 are cross-distro notices (Debian DSA/DLA, SUSE, Mageia, Root-OS, ECHO, TuxCare, USNs for unrelated
release series) whose fix versions belong to other package lines and therefore say nothing about 10.0p1.
Ten further advisories fixed OpenSSH in the 10.0.x line (`10.0p2-160000.3.1/6.1/7.1`, `10.0p2-2.1`,
`10.0p1-4.1.mga10`) are notice-level records with no CVE alias in the payload, so they are not listed as
rows: https://bugzilla.suse.com/1251198, https://bugzilla.suse.com/1259642, https://bugzilla.suse.com/1271044,
https://advisories.mageia.org/MGASA-2026-0521.html.
## Pinning gaps
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| ghcr.io/9001/copyparty-ac:`latest` (image 2284b21e4259, built 2026-09-19) | 1.20.24 | GHSA-3c88-p299-7hvr + GHSA-hg99-jqfp-rf76 | medium + low | 1.20.25 / 1.20.26 | https://github.com/9001/copyparty/security/advisories/GHSA-3c88-p299-7hvr |
| ghcr.io/jellyfin/jellyfin:`latest` (image 6370ab0005b4, built 2026-09-15) | 12.1.0 | none affecting; tag floats, no digest pin | — | — | `podman image inspect ghcr.io/jellyfin/jellyfin:latest` |
| ghcr.io/rommapp/romm:`latest` (image eab97d88d9d7, commit 95599dad, built 2026-09-23) | 5.3.1 | none affecting; commit build with no version label (`org.opencontainers.image.version` empty) | — | — | `podman image inspect ghcr.io/rommapp/romm:latest` |
| docker.io/prom/node-exporter:`latest` (image 9bbbca8f5cb8, built 2026-07-14) | 1.12.1 | none affecting; 3-month-old `latest` on disk | — | — | `podman images docker.io/prom/node-exporter` |
| docker.io/library/mariadb:11 / library/redis:7-alpine | 11.8.9 (image built 2026-09-16) / 7.4.11 (image built 2026-08-18) | rolling tags; redis 7.4.11 carries 12 unresolved vendor advisories | up to high | see container table | https://github.com/redis/redis/security/advisories |
| gcr.io/cadvisor/cadvisor:v0.49.1 | v0.49.1, image built **2024-03-02** | no OSV entry, but the pin is 2.5 years old | — | — | `podman image inspect gcr.io/cadvisor/cadvisor:v0.49.1 --format {{.Created}}` |
| quadlet `Image=localhost/radiance-vllm:0.13.0-e060895` vs running container | quadlet names a locally built image (id `012d39ede956`, 2026-09-22); `frank-archon` actually runs `docker.io/stilldeadcode/radiance@sha256:d590e300…` (`radiance:1.8.1`) | n/a (provenance, not a CVE) | — | — | `podman ps --format '{{.Names}} {{.Image}}'`; `podman images` |
| lscr.io/linuxserver/plex (pinned tag) + `lscr.io/linuxserver/plex:latest` also on disk (`b9f135c281ce`, 4 weeks) | 1.43.5.11029-6bf8af3f0-ls329 | n/a | — | — | `podman images` on dankserver |
| stale local images retained on disk | `ghcr.io/everywall/ladder:latest` (2 years), `docker.io/ta264/docker-calibre:latest` (3 years), `localhost/radiance-vllm:0.9.3` | n/a — attack surface / rollback trap | — | — | `podman images` on dankserver |
| Ubuntu 26.04 staged updates not applied | 12 systemd-family packages (`systemd`, `libsystemd0`, `libpam-systemd`, `libnss-systemd`, `libsystemd-shared`, `libudev1`, `udev`, `systemd-resolved`, `systemd-timesyncd`, `systemd-oomd`, `systemd-cryptsetup`, `systemd-sysv`) 259.5-0ubuntu3.4 → 259.9-0ubuntu0.1, and `xserver-xorg-core`/`xserver-common`/`xserver-xorg-dev` 2:21.1.22-1ubuntu1.2 → 2:21.1.22-1ubuntu1.3 — all offered from `resolute-updates` but held back (`apt-get -s upgrade` → `0 upgraded, 0 newly installed, 0 to remove and 15 not upgraded`) | not CVE-attributed this run | — | — | `ssh dankserver 'apt list --upgradable'` |
| blankpad kernel | running `7.2.9-1-cachyos` while `linux-cachyos 7.2.11-1` is installed (reboot pending) | unassessed (kernel not in Arch tracker) | — | — | `uname -r` vs `pacman -Q linux-cachyos` |
| blankpad foreign packages outside any sync DB | `handy-bin`, `herdr-bin`, `nirimod-git`, `typora` | no tracker coverage | — | — | `pacman -Qii` vs `/var/lib/pacman/sync/*.db` |
## Unverifiable
| component | installed/resolved version | CVE | severity | fixed in | source URL |
|---|---|---|---|---|---|
| lscr.io/linuxserver/plex (running build) | tag/label says 1.43.5.11029-6bf8af3f0-ls329; runtime version unconfirmed | no OSV entry (`plex-media-server` @ 1.43.5.11029 → `{}`); no Plex advisory feed consulted (none public) | — | — | `curl -s 127.0.0.1:32400/identity` → "Empty reply from server"; version taken from `podman exec plex cat /build_version` |
| library/mariadb:11 (11.8.9) | 11.8.9 (`podman exec romm-mariadb mariadb --version`) | upstream MariaDB has no OSV ecosystem; name-only query returns 310 cross-distro records (Debian/Ubuntu/Alpine builds) that cannot be attributed to this image | — | — | `curl -X POST https://api.osv.dev/v1/query -d '{"package":{"name":"mariadb"},"version":"11.8.9"}'` |
| lscr.io/linuxserver/calibre (9.15.0) | 9.15.0 | name-only OSV query returns 26 cross-distro records, none attributable; no Calibre advisory feed checked | — | — | `curl -X POST https://api.osv.dev/v1/query -d '{"package":{"name":"calibre"},"version":"9.15.0"}'` |
| linux kernel on dankserver (7.0.0-38.38) | 7.0.0-38.38 | 35 OSV records list the installed kernel in the `Ubuntu:26.04:LTS` affected set with no `fixed` event (e.g. CVE-2012-4542 low, CVE-2013-7445 medium, CVE-2015-7837, CVE-2016-8660, CVE-2020-26140, …). Ubuntu's own per-release status for such records is `needs-triage`/`ignored`, so these are **untriaged, not confirmed vulnerable**; per-CVE verification exceeded the call cap | mixed (low/medium, untriaged) | none published for 26.04 in these records | verify one row with: `curl -s https://ubuntu.com/security/cves/CVE-2013-7445.json` and read `packages[].statuses[]` for `release_codename=resolute` |
| redis 7.4.11 "unpatched upstream" rows | 7.4.11 | the redis/redis advisories above carry `patched_versions: TBD`, while downstream trackers in the same OSV response show fix levels at 8.0.4 / 7.0.15-rX — whether the 7.4 branch received these fixes is not stated by the vendor | high/medium | unresolved | https://github.com/redis/redis/security/advisories/GHSA-m8fj-85cg-7vhp |
| blankpad kernel (`linux-cachyos`) | installed 7.2.11-1, running 7.2.9-1-cachyos | Arch tracker has no `linux-cachyos` entry (its 683 package names include `linux` and `linux-lts` only), so a CachyOS-built kernel cannot be assessed by name. Three `linux` advisories are still open upstream — AVG-1879 (CVE-2021-43976 etc., medium), AVG-2345 (CVE-2021-31615 etc., medium), AVG-1594 (CVE-2020-35501, low) — all baselined at `5.15.8.arch1-1` | unresolved | — | https://security.archlinux.org/AVG-1879, https://security.archlinux.org/AVG-2345, https://security.archlinux.org/AVG-1594 |
| danklivingroom OS + package inventory | unknown (`OS unknown`) | password-auth-only host; every non-OpenSSH component (OS release, container runtime, media stack) unassessed | — | — | `ssh -o BatchMode=yes dank@192.168.0.40 'uname -a'` → `Permission denied (publickey,password).`; raw banner read on 192.168.0.215:22 timed out (`/dev/tcp` probe), so 10.0 is the reported banner version, not one I captured |
| localhost/radiance-vllm:0.13.0-e060895 embedded vllm version | tag-derived 0.13.0 only; the image's only labels are `org.opencontainers.image.ref.name=ubuntu` / `org.opencontainers.image.version=24.04` (base image metadata, image `012d39ede956` built 2026-09-22), and the running `frank-archon` container has no python to confirm | 50 advisories assessed against 0.13.0 — if the fork carries a different vllm base, that whole row set changes | — | — | `podman image inspect localhost/radiance-vllm:0.13.0-e060895 --format '{{json .Config.Labels}}'`; `podman exec frank-archon python3 -c "import vllm"` → `exec: "python3": executable file not found in $PATH` |
Reference in new issue View Git Blame Copy Permalink