Information Disclosure

Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 8.9, 9.0, and 9.1 allows remote authenticated users to affect confidentiality via unknown vectors. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 7.5.2 and 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 7.5.2, 10.1.3.5.1, 11.1.1.3, 11.1.1.4, and 11.1.1.5 allows remote authenticated users to affect. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.

Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 7.5.2, 10.1.3.5.1, 11.1.1.3, 11.1.1.4, and 11.1.1.5 allows remote attackers to affect confidentiality. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.1.0.5, 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.1.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Administration. Rated low severity (CVSS 3.7). No vendor patch available.

Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unspecified vulnerability in Oracle OpenSSO 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Administration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.2 and 12.1.3 allows remote authenticated users to affect confidentiality, related to REST. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 9.2.4, 10.0.2, 10.3.3, 10.3.4, and 10.3.5 allows remote authenticated users to affect integrity, related. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable. No vendor patch available.

Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.0 and 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect integrity via unknown vectors. Rated low severity (CVSS 1.7), this vulnerability is remotely exploitable. No vendor patch available.

Unspecified vulnerability in the PeopleSoft Enterprise CRM component in Oracle PeopleSoft Products 8.9 allows remote authenticated users to affect integrity via unknown vectors related to Sales. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Unspecified vulnerability in the Oracle Forms component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Unspecified vulnerability in the Listener component in Oracle Database Server 10.1.0.5, 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, and 11.2.0.2 allows remote attackers to affect availability via unknown. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.27 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Untrusted search path vulnerability in the Windows Object Packager configuration in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a Trojan horse. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 53.5% and no vendor patch available.

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.

Local privilege escalation in Windows afd.sys (Ancillary Function Driver) allows unauthenticated local attackers to gain SYSTEM privileges on Windows XP SP2/SP3 and Server 2003 SP2 through a crafted application requiring user interaction. CISA KEV confirms active exploitation in the wild, with EPSS score at 67.09% (99th percentile) indicating extremely high real-world exploitation likelihood. Multiple public exploit codes exist (Exploit-DB 21844, 18176), making this vulnerability trivially exploitable despite its age. Microsoft released patches via MS11-080 in October 2011, but legacy systems remain vulnerable.

Local privilege escalation in Microsoft Windows kernel-mode driver allows unprivileged users to gain SYSTEM-level access via malicious keyboard layout files. Affected platforms include Windows XP SP3, Windows Server 2003 SP2, Windows 7, and Windows Server 2008/R2 across all architectures. This vulnerability achieved widespread notoriety as one of four zero-days leveraged by the Stuxnet worm in July 2010 for industrial espionage and sabotage operations. Public exploit code exists (Exploit-DB 15985) with 8.88% EPSS score (92nd percentile), though no current KEV listing exists, suggesting exploitation was primarily limited to the Stuxnet campaign rather than ongoing widespread abuse. Microsoft released patches in MS10-073 (October 2010).

Local privilege escalation in Windows Task Scheduler allows authenticated users to execute code with SYSTEM privileges through crafted scheduled tasks that exploit improper security context validation. Affects Windows Vista SP1/SP2, Windows Server 2008 (all service packs and editions), Windows Server 2008 R2, and Windows 7. Public exploit code exists (Exploit-DB 15589, 19930) with a 63% EPSS score (98th percentile), indicating high real-world exploitation probability despite requiring local access. Microsoft addressed this via MS10-092 bulletin in December 2010, though the note suggests potential overlap with CVE-2010-3888.

The Windows kernel from NT 3.1 through Windows 7 improperly validates BIOS calls on 32-bit x86 platforms with 16-bit application support enabled, allowing local users to gain SYSTEM privileges and bypass UAC.

CVE-2007-5633 is a security vulnerability (CVSS 7.2) that allows local users. Risk factors: public PoC available.

Local privilege escalation in Microsoft Internet Information Services 5.0 allows authenticated local users to execute arbitrary code with SYSTEM privileges by placing malicious DLLs in search path locations that IIS uses to load in-process components. Publicly available exploit code exists. EPSS score of 2.16% (84th percentile) indicates lower exploitation probability, consistent with the local attack vector requiring pre-existing system access. Addressed by Microsoft MS01-044 security bulletin in 2001.

Vulnerability in .NET 9 Runtime on Alpine Linux was patched in Alpine package version 9.0.18-r0. The specific vulnerability class, impact, and attack surface are not disclosed in the available intelligence - only that Alpine's vendor advisory triggered a package update. No CVSS score, CWE classification, or exploitation details are available at time of analysis, making risk quantification impossible without consulting upstream Microsoft or Alpine advisories directly.

netatalk on Alpine Linux received a security fix in package version 4.5.1-r0, addressing an unspecified vulnerability. The nature of the flaw, affected components, and attacker capabilities cannot be determined from the available data - only the Alpine Linux vendor advisory source and fixed package version are confirmed. No CVSS score, CWE classification, or vulnerability description has been published at time of analysis.

Samba on Alpine Linux received a security fix in package version 4.23.10-r0, addressing an unspecified vulnerability reported by the Alpine Linux vendor. The underlying flaw, affected attack surface, and exploitability are not disclosed in available intelligence - the CVE record contains only a changelog-style fix reference with no description, CVSS score, or CWE assignment. Security teams running Alpine Linux with Samba should treat this as an uncharacterized patch and apply it promptly given Samba's historically high-severity vulnerability surface (RCE, privilege escalation, authentication bypass). No public exploit and no CISA KEV listing have been identified at time of analysis.

GStreamer gst-plugins-good received a security fix in Alpine Linux package version 1.26.3-r0. The specific vulnerability class, impact, and affected functionality within this multimedia plugin collection are not disclosed in available intelligence sources. Alpine Linux vendor confirmed the fix, but no CVSS scoring, CWE classification, or technical description has been published, making full impact assessment impossible at this time.

GStreamer's gst-plugins-good package on Alpine Linux received a security fix in version 1.26.3-r0, addressing an unspecified vulnerability. The nature of the flaw, affected functionality, and attacker impact are not disclosed in the available data - only the vendor patch record from Alpine Linux confirms a security-relevant change. No CVSS score, CWE classification, or exploit intelligence is available to characterize severity or exploitability at this time.

GStreamer's gst-plugins-good package on Alpine Linux received a security fix in version 1.26.3-r0. The nature of the underlying vulnerability is not disclosed in available intelligence - no description, CVSS vector, CWE classification, or exploit details have been published at time of analysis. The fix is confirmed only by Alpine Linux's vendor advisory, making the actual impact, affected attack surface, and exploitability unknown pending further disclosure.

Arbitrary file write in Git LFS versions 0.5.2 through 3.7.0 allows a malicious repository to overwrite files outside the working tree when a user runs git lfs checkout or git lfs pull against a repository containing crafted symbolic or hard links that collide with LFS-tracked file paths. The flaw is fixed in v3.7.1 and is also exploitable in bare repositories under specific conditions. No public exploit identified at time of analysis, and EPSS is very low (0.05%), but the CVSS 4.0 score of 8.6 reflects the high integrity impact achievable through routine developer workflows.

Command injection and arbitrary file truncation in the Perl GD module before 2.86 (perl-gd 2.86-r0 on Alpine) arise because GD::Image's _make_filehandle helper opened filenames using Perl's two-argument open(). When an application passes an attacker-influenced filename to constructors like GD::Image->new or newFrom*, prefixes such as `cmd |`, `| cmd`, or `> file` are interpreted by Perl as a command pipe or redirect, yielding command execution or destructive file truncation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS is 0.26% (50th percentile).

py3-aiohttp in Alpine Linux received a security fix packaged as version 3.14.1-r0. The nature of the underlying vulnerability - its attack vector, impact, and exploitation conditions - is not described in the available intelligence. This CVE record is minimal: only the affected package name and the Alpine Linux fix version are confirmed. Security teams should consult the upstream aiohttp changelog and Alpine Linux security advisories for the actual vulnerability details before assessing risk.

Podman on Alpine Linux has been patched in package version 5.8.3-r0 to address CVE-2026-44517. No vulnerability description, CVSS score, CWE classification, KEV status, EPSS score, or technical detail is available from the provided intelligence. The nature of the flaw, its impact on confidentiality, integrity, or availability, and its exploitability cannot be characterized from current data.

Netatalk, the open-source Apple Filing Protocol (AFP) server, received a security fix in Alpine Linux package version 4.5.1-r0 addressing CVE-2026-62320. The nature of the underlying vulnerability - its attack vector, impact class, and affected component - is not disclosed in available intelligence sources. No public exploit has been identified at time of analysis, and the fix was reported solely by the Alpine Linux vendor without a corresponding upstream advisory or NVD enrichment.

netatalk, the open-source Apple Filing Protocol (AFP) server for Unix/Linux systems, received a security fix in Alpine Linux package version 4.5.1-r0. The nature of the underlying vulnerability is undisclosed in available data - no CVE description, CVSS vector, CWE classification, or vendor advisory detail has been published. Security teams managing Alpine Linux hosts running netatalk should treat this as an uncharacterized fix of unknown severity requiring upgrade. No public exploit or active exploitation has been identified at time of analysis.

netatalk on Alpine Linux received a security fix in package version 4.5.1-r0, addressing an unspecified vulnerability. The nature, impact, and attack surface of the underlying flaw are not disclosed in the available intelligence - no CVE description, CVSS vector, CWE classification, or advisory text has been published. Until vendor or NVD details are released, the scope of exposure cannot be determined beyond the fact that a fix exists for Alpine Linux users.

WEasyPrint on Alpine Linux was patched at package version 69.0-r0, addressing an unspecified vulnerability in the HTML-to-PDF rendering library. The upstream vulnerability details, including attack vector, impact class, and affected upstream version range, are not disclosed in the available intelligence. No exploitation status, CVSS scoring, or CWE classification has been published at this time, making precise impact assessment impossible without consulting the upstream WEasyPrint changelog or a vendor advisory.

Gitea received a security fix in Alpine Linux package version 1.27.1-r0, addressing an unspecified vulnerability tracked as CVE-2026-59774. The underlying vulnerability class, attack vector, and impact are not disclosed in the available intelligence. Administrators running Gitea on Alpine Linux should treat this as an uncharacterized security fix and upgrade promptly, as the absence of public detail does not imply low severity.

PHP 8.3 on Alpine Linux was patched in package version 8.3.32-r0, addressing an unspecified vulnerability tracked as CVE-2026-12184. The underlying vulnerability type, affected functionality, and attacker-achievable impact are not disclosed in the available intelligence - only the fixed Alpine package version is confirmed. No exploitation has been identified, and no CVSS score or CWE classification has been published at the time of this analysis.

Gitea received a security fix in Alpine Linux package version 1.27.1-r0, addressing an unspecified vulnerability in the Gitea self-hosted Git service. The upstream CVE record (CVE-2026-60004) contains minimal public detail - the nature, impact, and exploitability of the underlying flaw are not disclosed in available intelligence sources. Security teams running Gitea on Alpine Linux should treat the package update as a security-relevant change pending further disclosure.

Samba on Alpine Linux was patched in package version 4.23.10-r0, addressing an unspecified vulnerability. The nature of the flaw, affected attack surface, and potential impact are not derivable from the available data - only the fix version and affected platform (Alpine Linux) are confirmed. No CVSS score, CWE classification, or vulnerability description has been published at time of analysis, making risk characterization impossible without additional vendor disclosure.

Samba on Alpine Linux received a security fix in package version 4.23.10-r0, addressing an unspecified vulnerability. The underlying nature of the flaw, affected attack surface, and potential attacker impact cannot be determined from the available intelligence - no CVE description, CVSS vector, or CWE has been published. No public exploit identified at time of analysis, and no CISA KEV listing exists for this CVE.

libgit2, the portable C library implementing Git core methods, has a security fix issued in Alpine Linux package version 1.9.6-r0. The nature of the underlying vulnerability is not disclosed in available intelligence - only the fix version and the reporting vendor (Alpine) are confirmed. No CVSS score, CWE classification, or description of impact has been published, leaving the actual risk profile uncharacterized at time of analysis. No public exploit identified at time of analysis.

libgit2, the portable C library implementing Git core methods, received a security fix in Alpine Linux package version 1.9.6-r0. The nature, severity, and impact of the underlying vulnerability are not disclosed in available data - only the patched package version is confirmed by the Alpine Linux vendor advisory. No public exploit, KEV listing, CVSS score, or CWE classification is available at time of analysis.

libgit2 on Alpine Linux received a security fix packaged as version 1.9.6-r0, addressing an unspecified vulnerability. The underlying vulnerability type, affected upstream version range, and attacker-reachable impact are not disclosed in the available intelligence. The sole confirmed data point is that Alpine Linux has issued a corrected package; no CVSS scoring, CWE classification, KEV listing, or exploit evidence is present in the source data.

ImageMagick on Alpine Linux has been patched in package version 7.1.2.24-r0, addressing an unspecified vulnerability tracked as CVE-2026-48734. The nature of the flaw - including attack vector, impact class, and affected functionality - is not disclosed in the available intelligence. No CVSS score, CWE classification, or vendor security advisory with technical detail has been published at the time of this analysis, making precise impact assessment impossible without additional data.

lldpd on Alpine Linux was patched in package version 1.0.22-r0, addressing an unspecified vulnerability in the Link Layer Discovery Protocol daemon. The exact nature of the flaw - whether remote code execution, denial of service, information disclosure, or privilege escalation - is not disclosed in available data. CVSS score, vector, and CWE classification are all absent, meaning severity and exploitability cannot be quantified from current intelligence. No KEV listing or public exploit has been identified at time of analysis.

libssh in Alpine Linux was patched at package version 0.11.2-r0, addressing an unspecified vulnerability tracked as CVE-2025-5449. The nature of the vulnerability - its root cause, attack vector, and impact - is not disclosed in available intelligence sources. The EPSS score of 0.52% (67th percentile) indicates moderate relative ranking among CVEs but low absolute exploitation probability. No active exploitation has been confirmed, and no public exploit code has been identified at time of analysis.

libheif, a library for reading and writing HEIF and AVIF image files, received a security fix in Alpine Linux package version 1.21.2-r0. The specific vulnerability class, impact, and exploitation method are not described in available intelligence - the CVE record contains only a changelog-style fix notice from the Alpine Linux vendor. With an EPSS score of 0.04% (14th percentile), automated exploitation at scale is considered unlikely based on current threat intelligence signals, though the absence of CVSS data prevents a complete risk characterization. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.

Alpine Linux: mozjs fixed in 128.3.1-r0

ImageMagick on Alpine Linux received a security fix packaged as version 7.1.2.8-r0, addressing an unspecified vulnerability in the image processing library. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence sources - no CVE description, CVSS vector, or CWE classification has been published. With an EPSS score of 0.02% (5th percentile), automated or widespread exploitation is considered highly unlikely at this time.

ImageMagick on Alpine Linux was patched in package version 7.1.2.8-r0, addressing an unspecified vulnerability. The nature, class, and impact of the underlying flaw are not disclosed in available intelligence - no CVSS vector, CWE, or vendor description beyond the fix notice has been published. With an EPSS score of 0.08% (23rd percentile), exploitation probability is currently low, and no public exploit or active exploitation has been identified at time of analysis.

ImageMagick on Alpine Linux received a security fix packaged as version 7.1.2.12-r0, addressing an unspecified vulnerability in the image processing library. The nature of the underlying flaw, its impact class, and affected attack surface are not disclosed in available intelligence sources. With an EPSS score of 0.13% (32nd percentile), exploitation probability is low, and no public exploit or active exploitation has been identified at time of analysis.

ImageMagick on Alpine Linux was patched in package version 7.1.2.12-r0 to address CVE-2025-68950. The underlying vulnerability type, affected component, and technical impact are not described in the available data - only the fix version is confirmed by the Alpine Linux vendor advisory. With an EPSS score of 0.03% (9th percentile) and no KEV listing, this vulnerability shows no public exploitation signals at time of analysis.

ImageMagick on Alpine Linux received a security fix in package version 7.1.2.12-r0, addressing an unspecified vulnerability. The nature of the underlying flaw, affected attack surface, and potential attacker impact are not disclosed in available data - only the Alpine Linux vendor advisory confirms a fix was issued. EPSS score of 0.13% (32nd percentile) indicates low current exploitation probability, and no active exploitation or public exploit code has been identified at time of analysis.

ImageMagick on Alpine Linux received a security fix in package version 7.1.2.12-r0, addressing an unspecified vulnerability tracked as CVE-2025-68469. The nature of the flaw, affected attack surface, and potential impact are not disclosed in available intelligence - the only confirmed data point is the Alpine Linux vendor advisory indicating a patched package. No active exploitation has been identified, and EPSS scoring places this in the 6th percentile (0.02%), suggesting very low current exploitation probability.

ImageMagick received a security fix in Alpine Linux package version 7.1.2.12-r0, addressing an unspecified vulnerability in the image processing software. The vulnerability details - including attack vector, impact, and root cause - have not been publicly disclosed by the reporter (Alpine Linux vendor). With an EPSS score of 0.05% (15th percentile), exploitation probability is currently very low, and no public exploit or CISA KEV listing has been identified at time of analysis.

Go language runtime package in Alpine Linux was patched at package version 1.25.2-r0, addressing an unspecified vulnerability. The CVE record contains minimal disclosure - no CVSS score, no CWE classification, and no description beyond the fix notation, making precise impact characterization impossible from available data alone. EPSS probability is 0.05% (14th percentile), indicating very low observed exploitation probability at time of analysis; no active exploitation has been identified.

Go language runtime patched in Alpine Linux package version 1.25.2-r0 addresses an unspecified vulnerability with no disclosed technical details at time of analysis. The affected component is the Go toolchain/runtime as distributed by the Alpine Linux project. With an EPSS score of 0.02% (7th percentile) and no CVSS scoring, KEV listing, or public exploit, the real-world risk profile is currently low and uncharacterized.

Go runtime/toolchain package on Alpine Linux contains an unspecified vulnerability addressed in the Alpine package version 1.25.2-r0. The underlying nature, impact class, and affected component within Go are not disclosed in available intelligence sources. EPSS score of 0.04% (14th percentile) indicates a low current probability of observed exploitation, and no public exploit code or CISA KEV listing has been identified at time of analysis.

The Go language runtime/toolchain package in Alpine Linux contains an unspecified vulnerability addressed in the Alpine package version 1.25.2-r0. The nature, root cause, and exploitability of this vulnerability are not disclosed in the available intelligence data. With an EPSS score of 0.02% (5th percentile), the empirical exploitation probability is negligible at this time, and no public exploit or active exploitation has been identified.

CVE-2025-58188 represents a security fix applied to the Go language package in Alpine Linux, addressed in package version 1.25.2-r0. The nature, class, and precise impact of the underlying vulnerability are not disclosed in available data - only the fix version is confirmed. With an EPSS score of 0.01% (2nd percentile) and no CISA KEV listing, real-world exploitation is assessed as highly unlikely at this time. Security teams maintaining Alpine Linux environments running the Go runtime or toolchain should treat this as a routine patching obligation pending further vendor disclosure.

CVE-2025-58187 records a vulnerability in the Go programming language package as distributed by Alpine Linux, addressed in package version 1.25.2-r0. The nature, severity, and impact of the underlying vulnerability are entirely absent from the CVE record - no description, CVSS score, or CWE classification has been published. The EPSS score of 0.02% at the 6th percentile reflects very low modeled exploitation probability, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Alpine Linux patched its Go language runtime package at version 1.25.2-r0, addressing an unspecified vulnerability tracked as CVE-2025-58186. The nature, class, and impact of the underlying flaw are not disclosed in available intelligence - no description, CVSS score, CWE classification, or vendor advisory detail accompanies this record beyond the package fix version. With an EPSS score of 0.04% (13th percentile), probabilistic exploitation likelihood is very low at time of analysis.

The Go programming language package as distributed by Alpine Linux received a security fix in package version 1.25.2-r0. The vulnerability was reported exclusively by the Alpine Linux vendor and carries an EPSS score of 0.04% (11th percentile), indicating a very low current exploitation probability. No CVSS score, vector, CWE classification, or technical description of the underlying flaw is available in the provided intelligence data, making comprehensive impact assessment impossible without consulting the Alpine Linux security advisory directly.

Go language runtime/toolchain in Alpine Linux was patched in package version 1.25.2-r0, addressing an unspecified vulnerability. The upstream nature, affected component, and exploitability details are not disclosed in available data - only the Alpine vendor advisory confirming the fix is present. EPSS is very low at 0.02% (6th percentile), and no active exploitation has been identified.

Go language runtime/toolchain on Alpine Linux received a security fix packaged as version 1.25.2-r0 in the Alpine ecosystem. The underlying nature of the vulnerability is not described in available data - the CVE record contains only a terse patch notation referencing the Alpine package. With an EPSS score of 0.03% (8th percentile) and no CISA KEV listing, real-world exploitation risk appears low at time of analysis, though the absence of technical detail prevents confident severity assessment.

Go language runtime or toolchain package on Alpine Linux contains a vulnerability addressed in the alpine package version 1.24.5-r0. The upstream Go fix is bundled into this Alpine package revision, though the specific technical nature of the flaw - whether in the runtime, standard library, compiler, or toolchain - is not disclosed in available intelligence. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability.

ffmpeg on Alpine Linux was patched in package version 8.0-r0, addressing an unspecified vulnerability tracked as CVE-2025-59734. The nature of the flaw, affected attack surface, and attacker capabilities cannot be characterized from available data - no description, CVSS vector, or CWE has been published. EPSS scoring of 0.02% (6th percentile) indicates very low modeled exploitation probability at this time, and no public exploit or CISA KEV listing has been identified.

FFmpeg received a security fix in Alpine Linux package version 8.0-r0, addressing an unspecified vulnerability in the widely-used multimedia processing framework. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence - no CVSS score, CWE classification, or vulnerability description has been published at time of analysis. With an EPSS score of 0.02% (7th percentile), automated exploitation at scale is considered unlikely based on current signals, though this assessment is constrained by the near-total absence of technical detail.

ffmpeg, as packaged in Alpine Linux, was patched in package version 8.0-r0 to address CVE-2025-59732. The underlying vulnerability type, root cause, and impact scope are not disclosed in available intelligence sources. No CVSS score, vector, or CWE has been assigned at the time of this analysis, making precise impact assessment impossible without consulting upstream ffmpeg or Alpine Linux security advisories directly. EPSS scoring at 0.02% (6th percentile) indicates very low observed exploitation probability.

FFmpeg on Alpine Linux received a security fix packaged as version 8.0-r0 in the Alpine distribution. The nature of the underlying vulnerability - including its class, impact, and attack vector - is not disclosed in the available intelligence. EPSS places exploitation probability at 0.02% (6th percentile), indicating very low observed exploitation pressure at time of analysis. No active exploitation or public exploit code has been identified.

FFmpeg in Alpine Linux received a security fix in package version 8.0-r0, addressing an unspecified vulnerability with no published CVSS score, CWE classification, or technical description at time of analysis. The Alpine Linux vendor reported this CVE, indicating the fix is available in the Alpine package repository. With an EPSS score of 0.02% (6th percentile), no public exploit code identified, and no CISA KEV listing, real-world exploitation pressure appears low at this time.

FFmpeg on Alpine Linux received a security fix in package version 8.0-r0, addressing an unspecified vulnerability tracked as CVE-2025-59729. The nature of the flaw, its impact, and the affected component within FFmpeg are not disclosed in the available intelligence. With an EPSS score of 0.02% (6th percentile), exploitation probability is currently assessed as very low, though this signal is unreliable without knowing the vulnerability class or attack surface.

FFmpeg on Alpine Linux received a security fix packaged in version 8.0-r0 of the Alpine package repository. The underlying vulnerability details - including attack vector, affected component, and impact class - have not been publicly disclosed in NVD or vendor advisories available at time of analysis. EPSS scoring places this at the 6th percentile (0.02% exploitation probability), indicating very low likelihood of active or near-term exploitation.

dotnet8-runtime on Alpine Linux received a security fix in package version 8.0.21-r0. The underlying vulnerability details are not disclosed in the available advisory data - no description, CVSS score, or CWE has been published at time of analysis. The fix was reported exclusively by the Alpine Linux vendor, suggesting this is an Alpine-specific package update tracking an upstream .NET 8 runtime security issue.

strongSwan on Alpine Linux was patched in package version 6.0.6-r0, addressing an unspecified vulnerability. The underlying nature of the flaw - including its severity, attack vector, and impact class - is not disclosed in the available data. strongSwan is a widely deployed IPsec/IKE VPN daemon, meaning any exploitable vulnerability in this component could carry significant network security implications; however, no severity rating, exploit, or active exploitation has been confirmed from the available intelligence.

strongSwan on Alpine Linux has been patched in package version 6.0.6-r0, addressing an unspecified vulnerability. The nature of the flaw, affected upstream strongSwan versions prior to the fix, and the potential attacker impact are not disclosed in the available intelligence. Given that strongSwan is an IPsec-based VPN solution commonly deployed at network perimeters, any vulnerability in it carries inherent risk to network confidentiality and integrity. No exploit code or active exploitation has been identified at time of analysis.

dotnet8-runtime on Alpine Linux contains a security vulnerability addressed by the Alpine package update to version 8.0.21-r0. A publicly available exploit exists on Exploit-DB (EDB-52492), elevating practical risk despite the absence of CISA KEV confirmation. EPSS places this at the 82nd percentile (1.68%), indicating it ranks higher in exploitation likelihood than most published CVEs, though the precise vulnerability class and attack surface are not confirmed from available data.

dotnet8-runtime on Alpine Linux received a security fix in package version 8.0.21-r0, addressing an unspecified vulnerability. The nature, root cause, and exploitability of the underlying flaw are not described in available intelligence sources - only the patched Alpine package version is confirmed. EPSS score of 0.03% (9th percentile) indicates very low observed exploitation probability, and no public exploit code or active exploitation has been identified.

Docker on Alpine Linux contains an uncharacterized vulnerability addressed in the 28.3.3-r0 Alpine package release. The sparse disclosure - a single-line vendor advisory from Alpine Linux with no CVSS score, CWE, or technical description - means the specific vulnerability class, attack surface, and impact are not determinable from available data. With an EPSS score of 0.03% (10th percentile), exploitation probability is assessed as very low at this time, and no public exploit code or CISA KEV listing has been identified.

crun, a lightweight OCI container runtime written in C, received a security fix in Alpine Linux package version 1.28-r0. The nature of the underlying vulnerability is not disclosed in available intelligence - no CVSS score, CWE classification, or technical description has been published. The fix is confirmed by Alpine Linux as the sole reporting source, indicating this was addressed through the Alpine security advisory process. No public exploit has been identified at time of analysis.

Composer, the PHP dependency manager, received a security fix in Alpine Linux package version 2.9.3-r0. The nature, severity, and scope of the underlying vulnerability are not disclosed in available intelligence sources - the CVE record contains only a fix notation from the Alpine Linux vendor with no description of the flaw, affected functionality, or attack surface. No CVSS score, CWE classification, or exploit indicators are available; the EPSS exploitation probability is 0.03% (11th percentile), reflecting a very low current risk signal. Users running Composer on Alpine Linux should upgrade as a precaution.

Capstone disassembly framework on Alpine Linux received a security fix in package version 5.0.7-r0, though the nature and impact of the underlying vulnerability have not been publicly disclosed. The extremely terse CVE description - limited to a package version string - provides no detail on attack vector, affected component, or attacker-achievable impact. With an EPSS score of 0.04% (12th percentile), automated exploitation at scale appears unlikely, but the absence of disclosed technical detail prevents confident risk classification.

Capstone disassembly framework on Alpine Linux received a security fix in package version 5.0.7-r0, addressing an unspecified vulnerability. The nature, impact class, and exploitability of the underlying flaw are not disclosed in the available intelligence - no CVSS score, CWE classification, or vulnerability description has been published. With an EPSS score of 0.01% (3rd percentile), exploitation probability is extremely low, and no public exploit or CISA KEV listing exists at time of analysis.

Alpine Linux: buildah fixed in 1.37.4-r0

Alpine Linux: buildah fixed in 1.35.4-r0