Information Disclosure

GnuPG on Alpine Linux was patched in package version 2.4.9-r0, addressing an unspecified vulnerability tracked as CVE-2025-68973. The nature of the vulnerability - including attack vector, impact class, and affected functionality - is not disclosed in available intelligence sources. No CVSS score, CWE classification, or technical description has been published, making independent severity assessment impossible at this time. No public exploit or CISA KEV listing has been identified.

GnuPG on Alpine Linux is affected by a vulnerability addressed in Alpine package version 2.4.9-r0. The CVE record contains only a fix-availability notice from the Alpine Linux vendor with no published description, CVSS scoring, or CWE classification, making the specific vulnerability class, impact, and attack vector unconfirmed at time of analysis. Security teams should treat this as a vendor-confirmed defect warranting patch application, while monitoring upstream GnuPG and Alpine advisories for full disclosure.

BIND DNS server on Alpine Linux was patched at package version 9.20.15-r0, addressing an unspecified vulnerability in the ISC BIND 9.20.x release series. The underlying flaw details - including attack vector, impact class, and affected component - are not disclosed in the available CVE record, making precise impact assessment impossible at this time. EPSS exploitation probability is 0.03% (8th percentile), and no public exploit or CISA KEV listing has been identified.

ISC BIND received a security fix in Alpine Linux package version 9.20.15-r0, addressing CVE-2025-40778. The nature of the underlying vulnerability - its impact class, affected attack surface, and exploitability - is not determinable from the available data, as no CVSS vector, CWE classification, or vendor advisory details were provided. EPSS scoring of 0.01% at the 0th percentile indicates extremely low assessed exploitation probability at time of analysis. No public exploit identified at time of analysis.

ISC BIND DNS server software received a security fix in Alpine Linux package version 9.20.15-r0. The specific vulnerability details, attack surface, and impact class are not disclosed in available intelligence - the sole confirmed data point is that the Alpine Linux vendor issued a patched package. With an EPSS score of 0.07% (22nd percentile), exploitation probability is assessed as low at time of analysis, and no public exploit or active exploitation has been identified.

OpenEXR, the high dynamic range image library, received a security fix in Alpine Linux package version 3.4.2-r0 addressing CVE-2025-48073. The specific vulnerability class and technical details have not been disclosed in available intelligence sources, limiting precise characterization of attacker capability or impact scope. EPSS scoring places exploitation probability at 0.18% (39th percentile), indicating low-to-moderate real-world exploitation interest at the time of analysis, with no public exploit code and no CISA KEV listing confirmed.

OpenEXR, the high-dynamic-range image format library widely used in professional visual effects and imaging pipelines, has received a security fix in Alpine Linux package version 3.4.2-r0. The nature of the underlying vulnerability is not disclosed in available intelligence - no CVE description, CVSS vector, CWE classification, or vendor advisory detail accompanies this entry. The fix was reported solely by the Alpine Linux vendor channel. No public exploit code has been identified at time of analysis, and CISA KEV confirmation of active exploitation is absent.

OpenEXR, the high dynamic range image format library, has been patched in Alpine Linux at package version 3.4.2-r0. The underlying vulnerability details are not publicly disclosed at the time of analysis - no CVE description, CVSS vector, or CWE classification have been published. Alpine Linux's vendor advisory is the sole confirmed intelligence source, indicating this was identified and remediated at the distribution packaging level. With an EPSS score of 0.11% (29th percentile), exploitation probability is low, and no active exploitation has been reported.

OpenJDK 11 on Alpine Linux contains a vulnerability addressed in the Alpine package release 11.0.28_p6-r0. The specific vulnerability class, attack vector, and exploitability conditions are not disclosed in the available intelligence data - only the vendor fix version is confirmed. EPSS places this at the 67th percentile despite a low 0.52% absolute exploitation probability, suggesting moderate relative risk among tracked CVEs. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.

OpenJDK 11 on Alpine Linux received a security fix in package version 11.0.28_p6-r0, addressing one or more vulnerabilities tracked under CVE-2025-30749. The upstream fix corresponds to OpenJDK 11.0.28, which aligns with Oracle's Java SE quarterly Critical Patch Update (CPU) cycle. The specific vulnerability class, impact, and affected attack surface are not described in available data; EPSS scoring at the 84th percentile (2.12% absolute) indicates elevated exploitation probability relative to most CVEs, warranting prioritized patching on affected Alpine systems.

OpenJDK 11 on Alpine Linux contains a vulnerability addressed in package version 11.0.28_p6-r0. The specific nature of the flaw is not disclosed in available intelligence - the CVE description provides only a patch reference without elaborating on root cause, attack vector, or impact class. With an EPSS score at the 77th percentile despite a low raw probability (1.01%), the vulnerability is statistically more likely to be exploited than the majority of CVEs, though active exploitation has not been confirmed. Security teams running Alpine Linux with openjdk11 packages prior to 11.0.28_p6-r0 should treat this as a priority update pending further vendor disclosure.

OpenJDK 11 on Alpine Linux was patched in package version 11.0.28_p6-r0, addressing one or more unspecified vulnerabilities in the Java runtime. The vulnerability details, including attack vector, impact class, and affected functionality, are not disclosed in available intelligence - only the fix version is confirmed via the Alpine Linux vendor advisory. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.

OpenJDK 11 as packaged for Alpine Linux contains a vulnerability addressed in the 11.0.28_p6-r0 package release. The nature, impact, and attack surface of the underlying flaw are not disclosed in the available intelligence - the CVE record contains no description, CVSS score, or CWE classification. The EPSS score of 0.46% (64th percentile) indicates a moderate relative likelihood of exploitation compared to the broader CVE population, though the absolute probability remains low. No active exploitation has been identified at time of analysis.

mbedtls3 on Alpine Linux received a security fix in package version 3.6.7-r0, addressing an unspecified vulnerability in the mbedTLS cryptographic library. The vulnerability details, including attack vector, impact class, and affected functionality, are not disclosed in the available intelligence. No CVSS score, CWE classification, or technical description was provided by the Alpine Linux vendor advisory beyond the package version bump.

Mbed TLS (mbedtls3) received a security fix in Alpine Linux package version 3.6.7-r0, addressing an unspecified vulnerability. The nature of the flaw - whether it affects cryptographic operations, TLS handshake processing, certificate validation, or another component - is not disclosed in the available intelligence. No CVSS score, CWE classification, or vulnerability description has been published, making independent risk assessment impossible at this time.

mbedTLS version 3.x (packaged as mbedtls3) on Alpine Linux contains a vulnerability addressed in Alpine package version 3.6.7-r0. The underlying vulnerability details - including attack vector, impact class, and exploitation requirements - are not disclosed in the available intelligence. The only confirmed fact is that Alpine Linux's vendor advisory identifies a fix in the mbedtls3 3.6.7-r0 package. No CVSS score, CWE classification, or exploit status is available at time of analysis.

Xen hypervisor on Alpine Linux is affected by a security vulnerability tracked as XSA-491 (Xen Security Advisory 491). The Alpine Linux vendor has issued a patched package at version 4.21.1-r6 to address this issue. No CVSS score, vector, or detailed vulnerability description has been provided in the available intelligence data, making precise impact characterization impossible without referencing the upstream XSA-491 advisory directly.

Xen hypervisor (XSA-494) has been patched in Alpine Linux via the xen package update to version 4.21.1-r6. The underlying vulnerability class, technical root cause, and precise impact are not disclosed in the available intelligence - only the Alpine Linux vendor fix notice and advisory identifier XSA-494 are confirmed. Security teams running Xen on Alpine Linux should treat this as a priority patch given that Xen Security Advisories typically address privilege escalation, guest-to-host escape, or denial-of-service in hypervisor components, though none of these specifics are confirmed for this advisory.

Xen Hypervisor on Alpine Linux has been patched via XSA-492, with the fix distributed in Alpine's xen package version 4.21.1-r6. The vulnerability class, impact scope, and attack vector are not disclosed in the available intelligence data - only the vendor-confirmed fix version is known. Security teams running Xen on Alpine Linux should treat this as a hypervisor-level security fix and prioritize patching given that Xen vulnerabilities historically span privilege escalation, VM escape, and denial-of-service classes.

Xen hypervisor as packaged in Alpine Linux received a security fix tracked under Xen Security Advisory XSA-492 (CVE-2026-42490). The Alpine Linux vendor has confirmed the issue is resolved in package version 4.21.1-r6. The nature of the vulnerability, affected Xen upstream versions, and attacker impact cannot be characterized from the available data - no CVSS score, CWE classification, or advisory detail has been provided. No public exploit has been identified at time of analysis.

libheif on Alpine Linux contains a vulnerability addressed in package version 1.23.0-r0. The nature of the flaw - whether memory corruption, input validation failure, or another class - is not disclosed in available intelligence at time of analysis. Alpine Linux vendor advisory confirms a fix exists, but the specific impact, affected component within libheif, and exploitability conditions are not derivable from current data.

strongSwan, the widely deployed open-source IPsec/IKE VPN implementation, received a security fix in Alpine Linux package version 6.0.7-r0 addressing CVE-2026-47895. The nature, severity, and exploitability of the underlying vulnerability are not disclosed in available intelligence - no CVSS score, CWE classification, or technical description has been published at time of analysis. Alpine Linux vendor attribution confirms this is a real security fix, but the impact scope and attack surface remain uncharacterized from provided data.

ImageMagick on Alpine Linux has been patched in package version 7.1.2.24-r0, addressing an unspecified vulnerability tracked as CVE-2026-48734. The nature of the flaw - including attack vector, impact class, and affected functionality - is not disclosed in the available intelligence. No CVSS score, CWE classification, or vendor security advisory with technical detail has been published at the time of this analysis, making precise impact assessment impossible without additional data.

Denial of service in ImageMagick affects Alpine Linux package versions prior to 7.1.2.24-r0, where improper input validation allows remote attackers to trigger high availability impact without authentication or user interaction. The flaw is tracked under upstream advisory GHSA-8pj9-6897-74xc and was disclosed via Alpine's security tracking. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

CVE-2026-41083 is an uncharacterized vulnerability in the OCaml package as distributed by Alpine Linux. The vulnerability description provides no technical details about the flaw class, affected versions, or attacker-accessible impact. Alpine Linux has issued a fix, but the upstream fix version field reads '0', which is likely a data entry placeholder rather than a meaningful version string. No exploitation activity, CVSS scoring, or CWE classification is available at time of analysis.

Cacti, the open-source network monitoring and graphing solution, contains an unspecified vulnerability addressed in Alpine Linux package version 1.2.31-0. The vulnerability type, affected component, and attacker-accessible impact are not disclosed in the available intelligence. No public exploit has been identified at time of analysis, and CISA KEV listing is absent, leaving severity and exploitation conditions uncharacterized from the data provided.

Cacti, the network monitoring and graphing tool, received a security fix in Alpine Linux package version 1.2.31-0. The specific vulnerability class, technical root cause, and impact scope are not disclosed in the available intelligence. No CVSS score, CWE identifier, or advisory narrative accompanies this CVE at time of analysis, making independent severity assessment impossible from provided data alone.

JWT signature verification weakness in the Cacti network monitoring framework (fixed in 1.2.31) lets an authenticated low-privilege user forge or tamper with JSON Web Tokens whose signatures are not properly validated, undermining token integrity. The CWE-347 root cause combined with the vendor's 'Jwt Attack' and 'Information Disclosure' tags points to token forgery that can bypass intended authorization checks. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; it was reported through the Alpine Linux vendor channel and patched upstream by the Cacti project.

Cacti, the open-source network graphing and monitoring solution, has been patched in Alpine Linux at package version 1.2.31-0. The nature of the underlying vulnerability is not disclosed in the available data - no description, CWE classification, or CVSS scoring has been published at time of analysis. Alpine Linux's security team issued the fix, confirming a security-relevant change, but the specific impact class, affected component, and attack surface remain uncharacterized from available intelligence sources.

Cacti, a network monitoring and graphing tool packaged for Alpine Linux, has a security fix included in Alpine's cacti package version 1.2.31-0. The underlying vulnerability details - including attack vector, impact type, and affected component - are not disclosed in available intelligence sources. The sole confirmed data point is that Alpine Linux identified and remediated a security issue in their Cacti package at this version boundary.

Cacti network monitoring software on Alpine Linux has been patched in package version 1.2.31-0, addressing CVE-2026-39952. The underlying vulnerability type, root cause, and attacker-achievable impact are not described in any available intelligence source. No CVSS score, CWE classification, exploit code, or vendor advisory beyond the Alpine package fix note has been identified at time of analysis.

Cacti, the network monitoring and graphing tool packaged for Alpine Linux, received a security fix in version 1.2.31-0. The vulnerability details have not been publicly disclosed beyond the Alpine Linux vendor advisory indicating a patched package release. Because no CVSS score, CWE classification, or technical description is available, the nature, severity, and exploitability of the underlying flaw cannot be characterized at this time.

Cacti, the open-source network monitoring and graphing solution, received a security fix in Alpine Linux's packaged version 1.2.31-0. The nature of the underlying vulnerability is not disclosed in the available intelligence - no CVE description, CVSS score, CWE classification, or exploit details have been published at this time. The sole confirmed fact is that Alpine Linux issued a patched package, meaning users running Cacti on Alpine Linux below version 1.2.31-0 should upgrade. No public exploit identified at time of analysis.

Cacti network monitoring software received a security fix in Alpine Linux package version 1.2.31-0, addressing CVE-2026-39949. The underlying vulnerability type, attack vector, and specific impact are not disclosed in available intelligence - the sole data point is the Alpine Linux vendor advisory confirming a patched package version. No further characterization of attacker capabilities, affected components, or exploitation conditions can be made from available data without risk of fabrication.

Alpine Linux: opensc fixed in 0.26.0-r0

Cacti network monitoring software received a security fix packaged by Alpine Linux in version 1.2.31-0. The specific vulnerability details, attack vector, and impact have not been disclosed in the available intelligence - only the fix version is confirmed. No CVSS score, CWE classification, or technical description accompanies this CVE, making independent impact assessment impossible without additional vendor disclosure.

Cacti, the PHP-based network graphing and monitoring solution, received a security fix in Alpine Linux package version 1.2.31-0 addressing CVE-2026-39902. The specific nature of the vulnerability - its type, attack vector, and impact - is not disclosed in the available intelligence data. No exploitation status, CVSS score, or CWE classification is present, making it impossible to characterize attacker capability or affected scope beyond the confirmed patch version.

Cacti, the PHP-based network monitoring and graphing solution, has been patched in Alpine Linux at version 1.2.31-0. The nature of the underlying vulnerability is not disclosed in the available intelligence - only the Alpine Linux vendor advisory confirms that a fix was applied at this version boundary. No CVSS score, CWE classification, or technical description is available, making independent risk assessment impossible without consulting upstream Cacti release notes or the Alpine Linux changelog.

Cacti, the open-source network graphing and monitoring solution, received a security fix in Alpine Linux package version 1.2.31-0. The nature, impact class, and root cause of this vulnerability are not disclosed in the available intelligence data - the sole data point is the Alpine Linux vendor advisory confirming a patched package. No CVSS score, CWE classification, or vulnerability description has been published at time of analysis, making independent risk assessment impossible without additional vendor disclosure.

Cacti, a widely-deployed network monitoring and graphing tool, has been patched in Alpine Linux's package ecosystem at version 1.2.31-0. The underlying vulnerability details - including attack vector, impact class, and exploitation mechanism - are not disclosed in the available intelligence. No CVSS score, CWE classification, or vendor description has been published at time of analysis, making precise impact characterization impossible. No public exploit or CISA KEV listing is associated with this CVE.

Cacti, the open-source network monitoring and graphing solution, has been patched in Alpine Linux at package version 1.2.31-0. The nature of the underlying vulnerability is not disclosed in available intelligence - no CVE description, CVSS vector, CWE classification, or vendor advisory beyond the Alpine security tracker entry has been identified at time of analysis. Security teams running Cacti on Alpine Linux should treat this as an uncharacterized but vendor-confirmed fix requiring upgrade. No public exploit or active exploitation has been identified.

Cacti, the open-source network monitoring and graphing tool, has a vulnerability addressed in Alpine Linux package version 1.2.31-0 (corresponding to Cacti upstream 1.2.31). The nature, impact, and attack surface of this vulnerability are not disclosed in available intelligence - no CVE description, CWE classification, or CVSS scoring has been published at time of analysis. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.

Cacti, the PHP-based network monitoring and graphing solution, has received a security fix in Alpine Linux's packaging at version 1.2.31-0. The nature of the underlying vulnerability - its attack vector, impact, and exploitability - is not disclosed in available intelligence. No CVSS score, CWE classification, or vendor security advisory beyond the Alpine Linux package changelog has been identified at time of analysis, making authoritative risk assessment impossible without further data.

CVE-2026-39895 affects Cacti as packaged for Alpine Linux, with a fix available in Alpine package version 1.2.31-0. The underlying vulnerability type, attack vector, and impact are not disclosed in the available data - the sole intelligence source is an Alpine Linux vendor report confirming the fix. No CVSS score, CWE, or detailed description has been published at the time of this analysis, making it impossible to characterize the precise risk without additional vendor or NVD disclosure.

BIND DNS server received a security fix in Alpine Linux package version 9.20.11-r0, addressing an unspecified vulnerability tracked as CVE-2025-40777. The affected product is ISC BIND as packaged in Alpine Linux, with the fix delivered via the Alpine package repository. No public exploit has been identified at time of analysis, and the EPSS score of 0.10% (27th percentile) reflects low observed exploitation probability.

ISC BIND DNS server received a security fix in Alpine Linux package version 9.20.11-r0, addressing an unspecified vulnerability tracked as CVE-2025-40776. The underlying nature of the flaw - including attack vector, affected component, and exploitability conditions - has not been publicly disclosed at time of analysis. With an EPSS score of 0.05% (15th percentile) and no CISA KEV listing, this vulnerability does not currently exhibit signals of widespread active exploitation, though the absence of CVSS and CWE data substantially limits risk characterization.

Client-side memory corruption in FreeRDP (all versions before 3.27.1) lets a malicious or compromised RDP server compromise a connecting client through improperly bounds-checked bitmap cache orders. The cacheId field of Cache Bitmap V2/V3 orders was masked to only two bits (0x0003) instead of three (0x0007) and used to index cell-cache arrays without validating it against the negotiated number of cells, enabling out-of-bounds access controlled by the server. There is no public exploit identified at time of analysis and EPSS is low (0.45%, 36th percentile), but the CVSS 8.8 reflects full confidentiality, integrity and availability impact once a user connects to the attacker's server.

Out-of-bounds read in FreeRDP's H264 decompression codec allows a malicious or compromised RDP server to trigger memory disclosure and potential client crash when a user connects and receives crafted video frames with mismatched dimensions. Affected clients include all FreeRDP builds prior to 3.27.0 using any of the supported H264 backends (FFmpeg, OpenH264, Android MediaCodec, Windows Media Foundation). No public exploit has been identified at time of analysis, though CVSS 4.0 signals high confidentiality and availability impact with only passive user interaction required.

Alpine Linux: opensc fixed in 0.26.0-r0

FreeRDP received a security fix in Alpine Linux package version 3.27.1-r0, addressing an undisclosed vulnerability. The nature, severity, and impact of the underlying flaw are not specified in the available intelligence - no CVE description, CVSS score, CWE classification, or advisory has been published at time of analysis. FreeRDP is an open-source RDP client and server implementation widely used on Linux systems; until further details are disclosed, the risk to affected deployments cannot be quantified.

OpenBao, the open-source fork of HashiCorp Vault, has a vulnerability addressed in Alpine Linux package version 2.5.4-r0. The specific nature of the flaw, its attack vector, and its impact have not been disclosed in available intelligence sources at time of analysis. No CVSS score, CWE classification, or detailed description has been published, making independent severity assessment impossible from current data.

OpenBao, the open-source secrets management fork of HashiCorp Vault, received a security fix in Alpine Linux package version 2.4.3-r0. The nature of the underlying vulnerability is not disclosed in available intelligence sources - no CVE description, CVSS vector, or CWE has been published. With an EPSS score of 0.05% (16th percentile), exploitation probability is very low at time of analysis, and no public exploit or CISA KEV listing exists.

OpenBao, an open-source secrets management platform and Linux Foundation-maintained fork of HashiCorp Vault, received a security fix in Alpine Linux package version 2.4.3-r0 addressing CVE-2025-62513. The vulnerability details, attack vector, and impact class are not disclosed in available intelligence, making precise characterization of attacker capability impossible at this time. EPSS scoring of 0.05% (16th percentile) indicates very low observed exploitation probability, and no public exploit code or CISA KEV listing has been identified at time of analysis.

OpenBao, an open-source secrets management platform forked from HashiCorp Vault, received a security fix in Alpine Linux package version 2.4.1-r0 addressing CVE-2025-59043. The vulnerability details, affected component, and exploitability conditions are not publicly disclosed in available intelligence sources at time of analysis. EPSS scoring places this at the 37th percentile (0.16% exploitation probability), suggesting low observed exploitation pressure, and no public exploit code or CISA KEV listing has been identified.

Integer underflow (CWE-191) in Netatalk, the open-source Apple Filing Protocol (AFP) server, allows a network-authenticated attacker to trigger memory corruption that may result in information disclosure, arbitrary code execution, or denial of service. The vulnerability affects versions prior to 4.4.3 and is patched in Netatalk 4.4.3 (Alpine Linux package 4.4.3-r0). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Netatalk on Alpine Linux contains an unspecified vulnerability addressed by the Alpine package maintainers in version 4.4.3-r0. The nature of the flaw, affected attack surface, and impact have not been disclosed in the available intelligence - the sole data point is the vendor-issued Alpine Linux package fix. Security teams should treat this as a pending-disclosure patch event and apply the update while awaiting a full CVE write-up.

netatalk on Alpine Linux was patched in package version 4.4.3-r0 to address an unspecified vulnerability. The nature of the flaw - its attack vector, impact class, and exploitation requirements - is not disclosed in the available intelligence. netatalk implements the Apple Filing Protocol (AFP), a network file-sharing service, meaning any vulnerability in this daemon carries potential network-exposure risk if the service is internet- or LAN-facing. No CVSS score, CWE classification, or active exploitation data has been provided.

netatalk on Alpine Linux has been patched in package version 4.4.3-r0, addressing an unspecified vulnerability tracked as CVE-2026-45355. The underlying vulnerability type, impact, and affected attack surface are not disclosed in the available intelligence. The fix originates solely from an Alpine Linux vendor advisory; no upstream netatalk security advisory, CVE description, or CVSS data is present to characterize attacker capability or exploitability.

netatalk on Alpine Linux has been patched in package version 4.4.3-r0 per an Alpine Linux vendor advisory. The nature, severity, and exploitability of this vulnerability are not determinable from the available data - no CVSS score, vector, CWE classification, or technical description has been published. netatalk is an open-source AFP (Apple Filing Protocol) server daemon, meaning any impact would likely affect network file-sharing services on Alpine Linux hosts. Security teams should treat this as an uncharacterized fix requiring vendor follow-up until fuller disclosure is available.

Alpine Linux: mozjs fixed in 128.3.1-r0

lldpd on Alpine Linux was patched in package version 1.0.22-r0, addressing an unspecified vulnerability in the Link Layer Discovery Protocol daemon. The exact nature of the flaw - whether remote code execution, denial of service, information disclosure, or privilege escalation - is not disclosed in available data. CVSS score, vector, and CWE classification are all absent, meaning severity and exploitability cannot be quantified from current intelligence. No KEV listing or public exploit has been identified at time of analysis.

libssh in Alpine Linux was patched at package version 0.11.2-r0, addressing an unspecified vulnerability tracked as CVE-2025-5449. The nature of the vulnerability - its root cause, attack vector, and impact - is not disclosed in available intelligence sources. The EPSS score of 0.52% (67th percentile) indicates moderate relative ranking among CVEs but low absolute exploitation probability. No active exploitation has been confirmed, and no public exploit code has been identified at time of analysis.

libheif, a library for reading and writing HEIF and AVIF image files, received a security fix in Alpine Linux package version 1.21.2-r0. The specific vulnerability class, impact, and exploitation method are not described in available intelligence - the CVE record contains only a changelog-style fix notice from the Alpine Linux vendor. With an EPSS score of 0.04% (14th percentile), automated exploitation at scale is considered unlikely based on current threat intelligence signals, though the absence of CVSS data prevents a complete risk characterization. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.

ImageMagick on Alpine Linux received a security fix packaged as version 7.1.2.8-r0, addressing an unspecified vulnerability in the image processing library. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence sources - no CVE description, CVSS vector, or CWE classification has been published. With an EPSS score of 0.02% (5th percentile), automated or widespread exploitation is considered highly unlikely at this time.

ImageMagick on Alpine Linux was patched in package version 7.1.2.8-r0, addressing an unspecified vulnerability. The nature, class, and impact of the underlying flaw are not disclosed in available intelligence - no CVSS vector, CWE, or vendor description beyond the fix notice has been published. With an EPSS score of 0.08% (23rd percentile), exploitation probability is currently low, and no public exploit or active exploitation has been identified at time of analysis.

ImageMagick on Alpine Linux received a security fix packaged as version 7.1.2.12-r0, addressing an unspecified vulnerability in the image processing library. The nature of the underlying flaw, its impact class, and affected attack surface are not disclosed in available intelligence sources. With an EPSS score of 0.13% (32nd percentile), exploitation probability is low, and no public exploit or active exploitation has been identified at time of analysis.

ImageMagick on Alpine Linux was patched in package version 7.1.2.12-r0 to address CVE-2025-68950. The underlying vulnerability type, affected component, and technical impact are not described in the available data - only the fix version is confirmed by the Alpine Linux vendor advisory. With an EPSS score of 0.03% (9th percentile) and no KEV listing, this vulnerability shows no public exploitation signals at time of analysis.

ImageMagick on Alpine Linux received a security fix in package version 7.1.2.12-r0, addressing an unspecified vulnerability. The nature of the underlying flaw, affected attack surface, and potential attacker impact are not disclosed in available data - only the Alpine Linux vendor advisory confirms a fix was issued. EPSS score of 0.13% (32nd percentile) indicates low current exploitation probability, and no active exploitation or public exploit code has been identified at time of analysis.

ImageMagick on Alpine Linux received a security fix in package version 7.1.2.12-r0, addressing an unspecified vulnerability tracked as CVE-2025-68469. The nature of the flaw, affected attack surface, and potential impact are not disclosed in available intelligence - the only confirmed data point is the Alpine Linux vendor advisory indicating a patched package. No active exploitation has been identified, and EPSS scoring places this in the 6th percentile (0.02%), suggesting very low current exploitation probability.

ImageMagick received a security fix in Alpine Linux package version 7.1.2.12-r0, addressing an unspecified vulnerability in the image processing software. The vulnerability details - including attack vector, impact, and root cause - have not been publicly disclosed by the reporter (Alpine Linux vendor). With an EPSS score of 0.05% (15th percentile), exploitation probability is currently very low, and no public exploit or CISA KEV listing has been identified at time of analysis.

Go language runtime package in Alpine Linux was patched at package version 1.25.2-r0, addressing an unspecified vulnerability. The CVE record contains minimal disclosure - no CVSS score, no CWE classification, and no description beyond the fix notation, making precise impact characterization impossible from available data alone. EPSS probability is 0.05% (14th percentile), indicating very low observed exploitation probability at time of analysis; no active exploitation has been identified.

Go language runtime patched in Alpine Linux package version 1.25.2-r0 addresses an unspecified vulnerability with no disclosed technical details at time of analysis. The affected component is the Go toolchain/runtime as distributed by the Alpine Linux project. With an EPSS score of 0.02% (7th percentile) and no CVSS scoring, KEV listing, or public exploit, the real-world risk profile is currently low and uncharacterized.

Go runtime/toolchain package on Alpine Linux contains an unspecified vulnerability addressed in the Alpine package version 1.25.2-r0. The underlying nature, impact class, and affected component within Go are not disclosed in available intelligence sources. EPSS score of 0.04% (14th percentile) indicates a low current probability of observed exploitation, and no public exploit code or CISA KEV listing has been identified at time of analysis.

The Go language runtime/toolchain package in Alpine Linux contains an unspecified vulnerability addressed in the Alpine package version 1.25.2-r0. The nature, root cause, and exploitability of this vulnerability are not disclosed in the available intelligence data. With an EPSS score of 0.02% (5th percentile), the empirical exploitation probability is negligible at this time, and no public exploit or active exploitation has been identified.

Privilege escalation and information disclosure in the Incus container and VM manager (Alpine Linux package incus-feature, fixed in 7.3.0-r0) lets a low-privileged but authenticated user abuse attacker-controlled file names/paths (CWE-73) to reach data or resources outside their intended boundary, with a scope-changed impact reaching the host. The CVSS 9.9 rating reflects network reachability, low attack complexity, and full compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis; the issue is tracked in upstream advisory GHSA-fmjx-5j3g-997p.

Incus container and virtual machine manager on Alpine Linux contains an unspecified vulnerability fixed in package version 7.3.0-r0. The vulnerability affects the incus-feature package and was reported directly by the Alpine Linux vendor. No description of the flaw's nature, attack vector, or impact has been published - the CVE record is a minimal fix-notification entry with no technical detail, making independent risk assessment impossible at this time.

CVE-2026-62867 affects the incus-feature package on Alpine Linux, fixed in package version 7.3.0-r0. The available intelligence is limited to a single vendor-sourced Alpine Linux advisory with no description of the vulnerability class, attack vector, or exploitability. No CVSS score, CWE, or exploitation details have been published. The nature of the flaw - whether it involves privilege escalation, container escape, information disclosure, or another impact - is not determinable from the available data.

Alpine Linux has issued a package update fixing an unspecified Xen vulnerability tracked as XSA-502, resolved in the Alpine package xen-4.22.0-r0. The underlying flaw corresponds to Xen Security Advisory 502, but the specific vulnerability class, impact, and affected component have not been disclosed in the available intelligence. Without CVSS scoring, CWE classification, or an upstream XSA advisory body, the precise attacker capability - whether guest escape, privilege escalation, denial of service, or information disclosure - cannot be determined from the data provided.

Xen Hypervisor contains a vulnerability addressed by XSA-500, with Alpine Linux releasing a fix in xen package version 4.22.0-r0. The underlying technical details, affected subsystem, and attacker-achievable impact are not disclosed in the available intelligence - only the patch version and reporting vendor are confirmed. Security teams running Xen on Alpine Linux should apply the available update pending fuller disclosure from the Xen Security Team.

Xen Hypervisor is affected by a security vulnerability tracked as XSA-499 (CVE-2026-62427), addressed in Alpine Linux's xen package at version 4.22.0-r0. The nature, root cause, and impact of the flaw are not disclosed in the available data - the only confirmed intelligence is the Alpine Linux vendor fix. No CVSS scoring, CWE classification, KEV status, or exploit information is available at time of analysis.

Xen Hypervisor on Alpine Linux is affected by a security vulnerability tracked as XSA-499 (CVE-2026-62426), addressed in Alpine's xen package version 4.22.0-r0. The specific vulnerability class, affected Xen upstream version range, and attack impact are not disclosed in the available intelligence - the sole confirmed data point is the Alpine Linux vendor fix. No exploitation status, CVSS score, or CWE classification is available at time of analysis.

Xen Hypervisor on Alpine Linux received a security fix packaged as xen 4.22.0-r0, addressing the issue tracked as XSA-497. The underlying vulnerability details, impact class, and affected attack surface are not disclosed in the available intelligence - only the vendor fix confirmation from Alpine Linux is present. Without the XSA-497 advisory content, the specific impact to confidentiality, integrity, or availability cannot be characterized from this data alone.

Xen Hypervisor contains a vulnerability addressed by XSA-497, fixed in Alpine Linux's xen package at version 4.22.0-r0. The specific nature of the flaw - its attack vector, impact class, and exploitation conditions - is not disclosed in available intelligence; the sole confirmed data point is the Alpine Linux vendor fix. No CVSS score, CWE classification, or detailed technical description is available, preventing characterization of attacker capability or affected scope. No public exploit or CISA KEV listing has been identified at time of analysis.

Xen Hypervisor, as packaged in Alpine Linux, has been patched in version 4.22.0-r0 to address a vulnerability tracked as XSA-497. The specific nature of the flaw - its impact class, affected subsystem, and attacker capability - is not disclosed in the available intelligence. Alpine Linux's vendor advisory confirms the fix but provides no further technical detail, leaving the actual vulnerability behavior uncharacterized at time of analysis.

Xen Hypervisor contains a security vulnerability tracked as XSA-497, addressed in Alpine Linux's xen package version 4.22.0-r0. The specific vulnerability class, affected component, and impact are not disclosed in the available intelligence - only the Alpine Linux vendor advisory confirms a fix exists. Security teams running Xen on Alpine Linux should treat this as a priority patch given the hypervisor attack surface, which can include guest-to-host escapes, privilege escalation, or denial of service depending on the XSA class. No public exploit has been identified at time of analysis.

Xen Hypervisor, as packaged in Alpine Linux, received a security fix in package version 4.22.0-r0 addressing the issue tracked as XSA-497. The underlying vulnerability details, including attack vector, impact class, and affected Xen upstream versions, are not disclosed in the available intelligence - only Alpine's vendor advisory confirms a fix was shipped. Without the full XSA-497 advisory, the scope of exploitation risk cannot be characterized beyond the patch signal itself.

Xen Hypervisor on Alpine Linux contains a vulnerability addressed by XSA-495, patched in Alpine package xen-4.22.0-r0. The specific vulnerability class, affected Xen upstream version range, and attacker impact are not disclosed in the available intelligence - only the Alpine vendor fix is confirmed. Security teams running Xen on Alpine Linux should treat this as a hypervisor-level security issue warranting prompt patching, given that XSA advisories historically cover privilege escalation, information disclosure, or denial-of-service conditions affecting guest-to-host isolation.

Xen hypervisor on Alpine Linux was patched in package version 4.22.0-r0, addressing a security issue tracked as XSA-496 and CVE-2026-42492. The upstream Xen Security Advisory XSA-496 identifies the root cause, but the provided intelligence data contains no description, CVSS vector, CWE, or exploit details, making authoritative impact assessment impossible from this source alone. Security teams should consult the official XSA-496 advisory at xenbits.xen.org for the authoritative vulnerability description and scope.

XSA-498 affects Xen as packaged in Alpine Linux, with a vendor-confirmed fix tracked under CVE-2026-42491. The underlying vulnerability details are not publicly disclosed in the available intelligence - no description, CVSS vector, CWE, or exploit information has been provided. Alpine Linux has issued a package update, but the nature, impact, and exploitability of the flaw cannot be characterized from the data at hand.

libgit2, the portable C library implementing Git core methods, has a security fix issued in Alpine Linux package version 1.9.6-r0. The nature of the underlying vulnerability is not disclosed in available intelligence - only the fix version and the reporting vendor (Alpine) are confirmed. No CVSS score, CWE classification, or description of impact has been published, leaving the actual risk profile uncharacterized at time of analysis. No public exploit identified at time of analysis.