Information Disclosure

py3-tornado (the Python Tornado web framework packaged for Alpine Linux) contains a vulnerability addressed in Alpine package version 6.5.4-r0. The nature of the flaw - including its impact class, affected component, and exploitability - is not disclosed in available intelligence. The only confirmed remediation signal is the Alpine Linux vendor advisory fixing the package at version 6.5.4-r0. EPSS exploitation probability is very low at 0.03% (11th percentile), and no active exploitation or public proof-of-concept has been identified at time of analysis.

Tornado Python web framework on Alpine Linux received a security fix in package version 6.5.4-r0, addressing an uncharacterized vulnerability. The nature of the flaw, affected attack surface, and exploitability conditions are not disclosed in available intelligence - only the patched Alpine package version is confirmed. EPSS scoring places exploitation probability at 0.21% (44th percentile), suggesting low-to-moderate automated exploitation likelihood at time of analysis, with no public exploit identified at time of analysis.

py3-tornado in Alpine Linux received a security fix packaged as version 6.5.4-r0, addressing an unspecified vulnerability in the Tornado asynchronous Python web framework. The nature, severity, and impact of the underlying flaw are not disclosed in available intelligence - no CVE description, CVSS vector, or CWE classification has been published. With an EPSS score of 0.04% (11th percentile) and no public exploit identified at time of analysis, the current exploitation signal is very low, though the absence of severity data prevents meaningful risk contextualization.

BIND DNS server received a security fix in Alpine Linux package version 9.20.11-r0, addressing an unspecified vulnerability tracked as CVE-2025-40777. The affected product is ISC BIND as packaged in Alpine Linux, with the fix delivered via the Alpine package repository. No public exploit has been identified at time of analysis, and the EPSS score of 0.10% (27th percentile) reflects low observed exploitation probability.

PHP 8.3 on Alpine Linux was patched in package version 8.3.32-r0, addressing an unspecified vulnerability tracked as CVE-2026-12184. The underlying vulnerability type, affected functionality, and attacker-achievable impact are not disclosed in the available intelligence - only the fixed Alpine package version is confirmed. No exploitation has been identified, and no CVSS score or CWE classification has been published at the time of this analysis.

opam, the OCaml package manager, received a security fix in Alpine Linux package version 2.5.2-r0. The nature of the underlying vulnerability is not disclosed in the available intelligence - no CVE description, CWE classification, CVSS vector, or advisory detail has been published at time of analysis. The fix is confirmed by the Alpine Linux vendor, but the specific impact, attack vector, and affected upstream opam versions cannot be determined from the data provided.

Confirmed actively exploited vulnerability in qt6-qtwebengine on Alpine Linux has been patched in package version 6.10.1-r2. Qt6 WebEngine is a Chromium-based web content rendering component embedded in Qt6 applications; vulnerabilities in this component typically affect any application that renders untrusted web content. Despite CISA KEV confirmation of active exploitation, the EPSS score of 0.30% (53rd percentile) suggests exploitation has been targeted rather than widespread, warranting urgent patching prioritization nonetheless.

Qt6 WebEngine (qt6-qtwebengine) on Alpine Linux received a security fix in package version 6.10.1-r2, as reported by the Alpine Linux vendor. The exact nature of the vulnerability, affected attack surface, and potential attacker impact are not disclosed in available intelligence - no CVE description, CVSS score, or CWE classification has been published at time of analysis. Qt WebEngine embeds a Chromium-based rendering engine, meaning historical vulnerabilities in this component have ranged from memory corruption to sandbox escapes; however, no specific claim can be made about this CVE without further vendor disclosure.

Qt6 WebEngine (qt6-qtwebengine) on Alpine Linux has been patched in package version 6.10.1-r7, addressing an unspecified vulnerability. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence - no CVE description, CVSS score, CWE classification, or vendor advisory narrative has been published at time of analysis. Alpine Linux is the sole reporting source, and the fix is confirmed present in the Alpine package repository at version 6.10.1-r7.

Active exploitation confirmed by CISA KEV affects qt6-qtwebengine on Alpine Linux, with the vulnerability addressed in package version 6.9.1-r3. The specific vulnerability class and technical mechanism are not disclosed in available intelligence - the only confirmed data point beyond KEV status is the Alpine Linux package fix designation. Despite CISA KEV confirmation, the EPSS score of 0.25% (49th percentile) is notably low, indicating exploitation is targeted rather than widespread or automated. Any application or system running Alpine Linux with qt6-qtwebengine prior to 6.9.1-r3 should be treated as at risk given the confirmed exploitation status.

qt6-qtwebengine in Alpine Linux has been patched in package version 6.9.1-r3, addressing an unspecified vulnerability in the Qt6 WebEngine component. The underlying vulnerability type, attack vector, and impact are not disclosed in the available intelligence - only the Alpine Linux vendor advisory confirming a fix is present. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.25% (48th percentile), indicating below-average exploitation likelihood among all CVEs.

Qt WebEngine (qt6-qtwebengine) in Alpine Linux has been patched at package version 6.9.1-r3 to address CVE-2025-7657. The underlying vulnerability type, impact, and attack surface are not disclosed in available intelligence - the sole confirmed data point is the Alpine Linux vendor fix notice. EPSS scoring at 0.15% (35th percentile) indicates low current exploitation probability, and no public exploit code or CISA KEV listing has been identified at time of analysis.

qt6-qtwebengine on Alpine Linux was patched in package revision 6.9.1-r3, addressing an unspecified vulnerability in the Qt 6 WebEngine component - a Chromium-based web rendering engine embedded in Qt applications. The underlying vulnerability type, root cause, and precise impact are not disclosed in available intelligence; the Alpine Linux vendor advisory provides only the fix version without a description of the flaw. No public exploit or CISA KEV listing has been identified at time of analysis.

Alpine Linux: runc fixed in 1.1.12-r0

step-certificates on Alpine Linux contains a vulnerability patched in package version 0.29.0-r0. The underlying nature of the flaw - whether it affects certificate issuance, authentication flows, ACME protocol handling, or the CA signing logic - is not disclosed in available intelligence. The Alpine Linux vendor advisory confirms the fix, and the low EPSS score of 0.03% (9th percentile) indicates minimal observed exploitation activity at time of analysis.

Synapse (Matrix homeserver) on Alpine Linux contains an uncharacterized vulnerability addressed in package version 1.139.2-r0. The upstream nature, attack vector, and exploitability class are not disclosed in available intelligence. With an EPSS score of 0.05% (14th percentile), exploitation probability is currently low, and no active exploitation or public exploit code has been identified at time of analysis.

Synapse, the Matrix homeserver implementation, was patched in Alpine Linux package version 1.152.1-r0 to address CVE-2026-45078. The vulnerability details, including affected versions, attack vector, and impact class, are not disclosed in the available intelligence data. No CVSS score, CWE classification, KEV listing, or public exploit has been identified at time of analysis, making precise impact assessment impossible without consulting the upstream Matrix.org or Alpine Linux advisories directly.

Alpine Linux: vim fixed in 9.1.0678-r0

Synapse, the Matrix homeserver implementation, received a security fix in Alpine Linux package version 1.152.1-r0. The upstream Synapse version 1.152.1 contains the remediation. The nature, impact, and attack vector of this vulnerability are not disclosed in the available data - no description, CVSS score, CWE, or vendor advisory detail has been published at time of analysis.

PowerDNS Recursor (pdns-recursor) on Alpine Linux received a security fix packaged as version 5.3.1-r1. The underlying vulnerability nature, attack vector, and impact class are not disclosed in available intelligence - only the Alpine Linux vendor advisory confirms a fix was issued. With an EPSS score of 0.12% (30th percentile), exploitation probability is currently low. No active exploitation or public proof-of-concept has been identified at time of analysis.

PowerDNS Recursor (pdns-recursor) on Alpine Linux contains an uncharacterized vulnerability addressed in Alpine package version 5.3.1-r1. The nature, impact class, and attack surface of this vulnerability are not disclosed in available intelligence sources. With an EPSS score of 0.01% (1st percentile), exploitation probability is assessed as extremely low at this time. No active exploitation or public proof-of-concept has been identified.

PowerDNS Recursor (pdns-recursor) on Alpine Linux received a security fix in Alpine package version 5.2.5-r0, addressing CVE-2025-30192. The nature of the vulnerability - including its attack vector, impact class, and affected component - is not disclosed in the available intelligence data. No CVSS score, CWE classification, or vendor security advisory beyond the Alpine Linux fix notice has been identified at time of analysis. EPSS exploitation probability is low at 0.12% (30th percentile), and no public exploit code or CISA KEV listing has been identified.

Alpine Linux: opensc fixed in 0.26.0-r0

Alpine Linux: opensc fixed in 0.26.0-r0

Alpine Linux: opensc fixed in 0.26.0-r0

Alpine Linux: opensc fixed in 0.26.0-r0

OpenJDK 11 as packaged for Alpine Linux contains a vulnerability addressed in the 11.0.28_p6-r0 package release. The nature, impact, and attack surface of the underlying flaw are not disclosed in the available intelligence - the CVE record contains no description, CVSS score, or CWE classification. The EPSS score of 0.46% (64th percentile) indicates a moderate relative likelihood of exploitation compared to the broader CVE population, though the absolute probability remains low. No active exploitation has been identified at time of analysis.

OpenJDK 11 on Alpine Linux was patched in package version 11.0.28_p6-r0, addressing one or more unspecified vulnerabilities in the Java runtime. The vulnerability details, including attack vector, impact class, and affected functionality, are not disclosed in available intelligence - only the fix version is confirmed via the Alpine Linux vendor advisory. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.

OpenJDK 11 on Alpine Linux contains a vulnerability addressed in package version 11.0.28_p6-r0. The specific nature of the flaw is not disclosed in available intelligence - the CVE description provides only a patch reference without elaborating on root cause, attack vector, or impact class. With an EPSS score at the 77th percentile despite a low raw probability (1.01%), the vulnerability is statistically more likely to be exploited than the majority of CVEs, though active exploitation has not been confirmed. Security teams running Alpine Linux with openjdk11 packages prior to 11.0.28_p6-r0 should treat this as a priority update pending further vendor disclosure.

OpenJDK 11 on Alpine Linux received a security fix in package version 11.0.28_p6-r0, addressing one or more vulnerabilities tracked under CVE-2025-30749. The upstream fix corresponds to OpenJDK 11.0.28, which aligns with Oracle's Java SE quarterly Critical Patch Update (CPU) cycle. The specific vulnerability class, impact, and affected attack surface are not described in available data; EPSS scoring at the 84th percentile (2.12% absolute) indicates elevated exploitation probability relative to most CVEs, warranting prioritized patching on affected Alpine systems.

OpenJDK 11 on Alpine Linux contains a vulnerability addressed in the Alpine package release 11.0.28_p6-r0. The specific vulnerability class, attack vector, and exploitability conditions are not disclosed in the available intelligence data - only the vendor fix version is confirmed. EPSS places this at the 67th percentile despite a low 0.52% absolute exploitation probability, suggesting moderate relative risk among tracked CVEs. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.

OpenEXR, the high dynamic range image format library, has been patched in Alpine Linux at package version 3.4.2-r0. The underlying vulnerability details are not publicly disclosed at the time of analysis - no CVE description, CVSS vector, or CWE classification have been published. Alpine Linux's vendor advisory is the sole confirmed intelligence source, indicating this was identified and remediated at the distribution packaging level. With an EPSS score of 0.11% (29th percentile), exploitation probability is low, and no active exploitation has been reported.

OpenEXR, the high-dynamic-range image format library widely used in professional visual effects and imaging pipelines, has received a security fix in Alpine Linux package version 3.4.2-r0. The nature of the underlying vulnerability is not disclosed in available intelligence - no CVE description, CVSS vector, CWE classification, or vendor advisory detail accompanies this entry. The fix was reported solely by the Alpine Linux vendor channel. No public exploit code has been identified at time of analysis, and CISA KEV confirmation of active exploitation is absent.

OpenEXR, the high dynamic range image library, received a security fix in Alpine Linux package version 3.4.2-r0 addressing CVE-2025-48073. The specific vulnerability class and technical details have not been disclosed in available intelligence sources, limiting precise characterization of attacker capability or impact scope. EPSS scoring places exploitation probability at 0.18% (39th percentile), indicating low-to-moderate real-world exploitation interest at the time of analysis, with no public exploit code and no CISA KEV listing confirmed.

OpenBao, the open-source fork of HashiCorp Vault, has a vulnerability addressed in Alpine Linux package version 2.5.4-r0. The specific nature of the flaw, its attack vector, and its impact have not been disclosed in available intelligence sources at time of analysis. No CVSS score, CWE classification, or detailed description has been published, making independent severity assessment impossible from current data.

OpenBao, the open-source secrets management fork of HashiCorp Vault, received a security fix in Alpine Linux package version 2.4.3-r0. The nature of the underlying vulnerability is not disclosed in available intelligence sources - no CVE description, CVSS vector, or CWE has been published. With an EPSS score of 0.05% (16th percentile), exploitation probability is very low at time of analysis, and no public exploit or CISA KEV listing exists.

OpenBao, an open-source secrets management platform and Linux Foundation-maintained fork of HashiCorp Vault, received a security fix in Alpine Linux package version 2.4.3-r0 addressing CVE-2025-62513. The vulnerability details, attack vector, and impact class are not disclosed in available intelligence, making precise characterization of attacker capability impossible at this time. EPSS scoring of 0.05% (16th percentile) indicates very low observed exploitation probability, and no public exploit code or CISA KEV listing has been identified at time of analysis.

OpenBao, an open-source secrets management platform forked from HashiCorp Vault, received a security fix in Alpine Linux package version 2.4.1-r0 addressing CVE-2025-59043. The vulnerability details, affected component, and exploitability conditions are not publicly disclosed in available intelligence sources at time of analysis. EPSS scoring places this at the 37th percentile (0.16% exploitation probability), suggesting low observed exploitation pressure, and no public exploit code or CISA KEV listing has been identified.

Integer underflow (CWE-191) in Netatalk, the open-source Apple Filing Protocol (AFP) server, allows a network-authenticated attacker to trigger memory corruption that may result in information disclosure, arbitrary code execution, or denial of service. The vulnerability affects versions prior to 4.4.3 and is patched in Netatalk 4.4.3 (Alpine Linux package 4.4.3-r0). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Netatalk on Alpine Linux contains an unspecified vulnerability addressed by the Alpine package maintainers in version 4.4.3-r0. The nature of the flaw, affected attack surface, and impact have not been disclosed in the available intelligence - the sole data point is the vendor-issued Alpine Linux package fix. Security teams should treat this as a pending-disclosure patch event and apply the update while awaiting a full CVE write-up.

netatalk on Alpine Linux was patched in package version 4.4.3-r0 to address an unspecified vulnerability. The nature of the flaw - its attack vector, impact class, and exploitation requirements - is not disclosed in the available intelligence. netatalk implements the Apple Filing Protocol (AFP), a network file-sharing service, meaning any vulnerability in this daemon carries potential network-exposure risk if the service is internet- or LAN-facing. No CVSS score, CWE classification, or active exploitation data has been provided.

netatalk on Alpine Linux has been patched in package version 4.4.3-r0, addressing an unspecified vulnerability tracked as CVE-2026-45355. The underlying vulnerability type, impact, and affected attack surface are not disclosed in the available intelligence. The fix originates solely from an Alpine Linux vendor advisory; no upstream netatalk security advisory, CVE description, or CVSS data is present to characterize attacker capability or exploitability.

netatalk on Alpine Linux has been patched in package version 4.4.3-r0 per an Alpine Linux vendor advisory. The nature, severity, and exploitability of this vulnerability are not determinable from the available data - no CVSS score, vector, CWE classification, or technical description has been published. netatalk is an open-source AFP (Apple Filing Protocol) server daemon, meaning any impact would likely affect network file-sharing services on Alpine Linux hosts. Security teams should treat this as an uncharacterized fix requiring vendor follow-up until fuller disclosure is available.

Alpine Linux: mozjs fixed in 128.3.1-r0

lldpd on Alpine Linux was patched in package version 1.0.22-r0, addressing an unspecified vulnerability in the Link Layer Discovery Protocol daemon. The exact nature of the flaw - whether remote code execution, denial of service, information disclosure, or privilege escalation - is not disclosed in available data. CVSS score, vector, and CWE classification are all absent, meaning severity and exploitability cannot be quantified from current intelligence. No KEV listing or public exploit has been identified at time of analysis.

libssh in Alpine Linux was patched at package version 0.11.2-r0, addressing an unspecified vulnerability tracked as CVE-2025-5449. The nature of the vulnerability - its root cause, attack vector, and impact - is not disclosed in available intelligence sources. The EPSS score of 0.52% (67th percentile) indicates moderate relative ranking among CVEs but low absolute exploitation probability. No active exploitation has been confirmed, and no public exploit code has been identified at time of analysis.

libheif, a library for reading and writing HEIF and AVIF image files, received a security fix in Alpine Linux package version 1.21.2-r0. The specific vulnerability class, impact, and exploitation method are not described in available intelligence - the CVE record contains only a changelog-style fix notice from the Alpine Linux vendor. With an EPSS score of 0.04% (14th percentile), automated exploitation at scale is considered unlikely based on current threat intelligence signals, though the absence of CVSS data prevents a complete risk characterization. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.

ImageMagick on Alpine Linux received a security fix packaged as version 7.1.2.8-r0, addressing an unspecified vulnerability in the image processing library. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence sources - no CVE description, CVSS vector, or CWE classification has been published. With an EPSS score of 0.02% (5th percentile), automated or widespread exploitation is considered highly unlikely at this time.

ImageMagick on Alpine Linux was patched in package version 7.1.2.8-r0, addressing an unspecified vulnerability. The nature, class, and impact of the underlying flaw are not disclosed in available intelligence - no CVSS vector, CWE, or vendor description beyond the fix notice has been published. With an EPSS score of 0.08% (23rd percentile), exploitation probability is currently low, and no public exploit or active exploitation has been identified at time of analysis.

ImageMagick on Alpine Linux received a security fix packaged as version 7.1.2.12-r0, addressing an unspecified vulnerability in the image processing library. The nature of the underlying flaw, its impact class, and affected attack surface are not disclosed in available intelligence sources. With an EPSS score of 0.13% (32nd percentile), exploitation probability is low, and no public exploit or active exploitation has been identified at time of analysis.

ImageMagick on Alpine Linux was patched in package version 7.1.2.12-r0 to address CVE-2025-68950. The underlying vulnerability type, affected component, and technical impact are not described in the available data - only the fix version is confirmed by the Alpine Linux vendor advisory. With an EPSS score of 0.03% (9th percentile) and no KEV listing, this vulnerability shows no public exploitation signals at time of analysis.

ImageMagick on Alpine Linux received a security fix in package version 7.1.2.12-r0, addressing an unspecified vulnerability. The nature of the underlying flaw, affected attack surface, and potential attacker impact are not disclosed in available data - only the Alpine Linux vendor advisory confirms a fix was issued. EPSS score of 0.13% (32nd percentile) indicates low current exploitation probability, and no active exploitation or public exploit code has been identified at time of analysis.

ImageMagick on Alpine Linux received a security fix in package version 7.1.2.12-r0, addressing an unspecified vulnerability tracked as CVE-2025-68469. The nature of the flaw, affected attack surface, and potential impact are not disclosed in available intelligence - the only confirmed data point is the Alpine Linux vendor advisory indicating a patched package. No active exploitation has been identified, and EPSS scoring places this in the 6th percentile (0.02%), suggesting very low current exploitation probability.

ImageMagick received a security fix in Alpine Linux package version 7.1.2.12-r0, addressing an unspecified vulnerability in the image processing software. The vulnerability details - including attack vector, impact, and root cause - have not been publicly disclosed by the reporter (Alpine Linux vendor). With an EPSS score of 0.05% (15th percentile), exploitation probability is currently very low, and no public exploit or CISA KEV listing has been identified at time of analysis.

Go language runtime package in Alpine Linux was patched at package version 1.25.2-r0, addressing an unspecified vulnerability. The CVE record contains minimal disclosure - no CVSS score, no CWE classification, and no description beyond the fix notation, making precise impact characterization impossible from available data alone. EPSS probability is 0.05% (14th percentile), indicating very low observed exploitation probability at time of analysis; no active exploitation has been identified.

Go language runtime patched in Alpine Linux package version 1.25.2-r0 addresses an unspecified vulnerability with no disclosed technical details at time of analysis. The affected component is the Go toolchain/runtime as distributed by the Alpine Linux project. With an EPSS score of 0.02% (7th percentile) and no CVSS scoring, KEV listing, or public exploit, the real-world risk profile is currently low and uncharacterized.

Go runtime/toolchain package on Alpine Linux contains an unspecified vulnerability addressed in the Alpine package version 1.25.2-r0. The underlying nature, impact class, and affected component within Go are not disclosed in available intelligence sources. EPSS score of 0.04% (14th percentile) indicates a low current probability of observed exploitation, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Apache HTTP Server (apache2) on Alpine Linux received a security fix packaged as version 2.4.65-r0. The underlying vulnerability details, including attack vector, impact class, and affected component, are not disclosed in the available intelligence - only the vendor-sourced fix notification is present. EPSS places this at the 76th percentile despite a low absolute probability (0.92%), suggesting it ranks notably above average for exploitation likelihood relative to the broader CVE population. No active exploitation (KEV) or public exploit code has been identified at time of analysis.

Singularity container runtime on Alpine Linux was patched in package version 4.4.2-r0 to address an unspecified vulnerability tracked as CVE-2026-47215. The nature of the vulnerability - including attack vector, impact class, and affected functionality - is not disclosed in the available intelligence. No public exploit has been identified at time of analysis, and the CVE has not appeared in the CISA KEV catalog.

The Go language runtime/toolchain package in Alpine Linux contains an unspecified vulnerability addressed in the Alpine package version 1.25.2-r0. The nature, root cause, and exploitability of this vulnerability are not disclosed in the available intelligence data. With an EPSS score of 0.02% (5th percentile), the empirical exploitation probability is negligible at this time, and no public exploit or active exploitation has been identified.

CVE-2025-58188 represents a security fix applied to the Go language package in Alpine Linux, addressed in package version 1.25.2-r0. The nature, class, and precise impact of the underlying vulnerability are not disclosed in available data - only the fix version is confirmed. With an EPSS score of 0.01% (2nd percentile) and no CISA KEV listing, real-world exploitation is assessed as highly unlikely at this time. Security teams maintaining Alpine Linux environments running the Go runtime or toolchain should treat this as a routine patching obligation pending further vendor disclosure.

CVE-2025-58187 records a vulnerability in the Go programming language package as distributed by Alpine Linux, addressed in package version 1.25.2-r0. The nature, severity, and impact of the underlying vulnerability are entirely absent from the CVE record - no description, CVSS score, or CWE classification has been published. The EPSS score of 0.02% at the 6th percentile reflects very low modeled exploitation probability, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Alpine Linux patched its Go language runtime package at version 1.25.2-r0, addressing an unspecified vulnerability tracked as CVE-2025-58186. The nature, class, and impact of the underlying flaw are not disclosed in available intelligence - no description, CVSS score, CWE classification, or vendor advisory detail accompanies this record beyond the package fix version. With an EPSS score of 0.04% (13th percentile), probabilistic exploitation likelihood is very low at time of analysis.

The Go programming language package as distributed by Alpine Linux received a security fix in package version 1.25.2-r0. The vulnerability was reported exclusively by the Alpine Linux vendor and carries an EPSS score of 0.04% (11th percentile), indicating a very low current exploitation probability. No CVSS score, vector, CWE classification, or technical description of the underlying flaw is available in the provided intelligence data, making comprehensive impact assessment impossible without consulting the Alpine Linux security advisory directly.

Go language runtime/toolchain in Alpine Linux was patched in package version 1.25.2-r0, addressing an unspecified vulnerability. The upstream nature, affected component, and exploitability details are not disclosed in available data - only the Alpine vendor advisory confirming the fix is present. EPSS is very low at 0.02% (6th percentile), and no active exploitation has been identified.

Go language runtime/toolchain on Alpine Linux received a security fix packaged as version 1.25.2-r0 in the Alpine ecosystem. The underlying nature of the vulnerability is not described in available data - the CVE record contains only a terse patch notation referencing the Alpine package. With an EPSS score of 0.03% (8th percentile) and no CISA KEV listing, real-world exploitation risk appears low at time of analysis, though the absence of technical detail prevents confident severity assessment.

Go language runtime or toolchain package on Alpine Linux contains a vulnerability addressed in the alpine package version 1.24.5-r0. The upstream Go fix is bundled into this Alpine package revision, though the specific technical nature of the flaw - whether in the runtime, standard library, compiler, or toolchain - is not disclosed in available intelligence. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (7th percentile) indicates very low observed exploitation probability.

ffmpeg on Alpine Linux was patched in package version 8.0-r0, addressing an unspecified vulnerability tracked as CVE-2025-59734. The nature of the flaw, affected attack surface, and attacker capabilities cannot be characterized from available data - no description, CVSS vector, or CWE has been published. EPSS scoring of 0.02% (6th percentile) indicates very low modeled exploitation probability at this time, and no public exploit or CISA KEV listing has been identified.

FFmpeg received a security fix in Alpine Linux package version 8.0-r0, addressing an unspecified vulnerability in the widely-used multimedia processing framework. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence - no CVSS score, CWE classification, or vulnerability description has been published at time of analysis. With an EPSS score of 0.02% (7th percentile), automated exploitation at scale is considered unlikely based on current signals, though this assessment is constrained by the near-total absence of technical detail.

ffmpeg, as packaged in Alpine Linux, was patched in package version 8.0-r0 to address CVE-2025-59732. The underlying vulnerability type, root cause, and impact scope are not disclosed in available intelligence sources. No CVSS score, vector, or CWE has been assigned at the time of this analysis, making precise impact assessment impossible without consulting upstream ffmpeg or Alpine Linux security advisories directly. EPSS scoring at 0.02% (6th percentile) indicates very low observed exploitation probability.

FFmpeg on Alpine Linux received a security fix packaged as version 8.0-r0 in the Alpine distribution. The nature of the underlying vulnerability - including its class, impact, and attack vector - is not disclosed in the available intelligence. EPSS places exploitation probability at 0.02% (6th percentile), indicating very low observed exploitation pressure at time of analysis. No active exploitation or public exploit code has been identified.

FFmpeg in Alpine Linux received a security fix in package version 8.0-r0, addressing an unspecified vulnerability with no published CVSS score, CWE classification, or technical description at time of analysis. The Alpine Linux vendor reported this CVE, indicating the fix is available in the Alpine package repository. With an EPSS score of 0.02% (6th percentile), no public exploit code identified, and no CISA KEV listing, real-world exploitation pressure appears low at this time.

FFmpeg on Alpine Linux received a security fix in package version 8.0-r0, addressing an unspecified vulnerability tracked as CVE-2025-59729. The nature of the flaw, its impact, and the affected component within FFmpeg are not disclosed in the available intelligence. With an EPSS score of 0.02% (6th percentile), exploitation probability is currently assessed as very low, though this signal is unreliable without knowing the vulnerability class or attack surface.

Mbed TLS (mbedtls) in Alpine Linux contains a vulnerability addressed in package version 4.1.1-r0. The nature of the flaw - whether it involves memory corruption, cryptographic weakness, or another class - is not disclosed in the available intelligence. The fix is confirmed by the Alpine Linux vendor advisory. No CVSS score, CWE classification, or exploitation data is available at time of analysis, making risk characterization largely indeterminate beyond the vendor's decision to issue a patch.

Samba on Alpine Linux was patched in package version 4.23.10-r0, addressing an unspecified vulnerability. The nature of the flaw, affected attack surface, and potential impact are not derivable from the available data - only the fix version and affected platform (Alpine Linux) are confirmed. No CVSS score, CWE classification, or vulnerability description has been published at time of analysis, making risk characterization impossible without additional vendor disclosure.

Mbed TLS (mbedtls) on Alpine Linux contains an unspecified vulnerability addressed in Alpine package version 4.1.1-r0. The nature of the flaw - whether it involves cryptographic weakness, memory corruption, or another class of defect - is not disclosed in the available intelligence. No CVSS score, CWE classification, or exploit data has been published. Security teams running Alpine Linux with mbedtls should treat this as a required update pending full upstream disclosure.

Mbed TLS (mbedtls) in Alpine Linux was patched in package release 4.1.1-r0, addressing an unspecified vulnerability. The nature of the flaw, affected upstream versions, and potential attacker impact cannot be determined from the available data - only the Alpine package fix version is confirmed. No CVSS score, CWE classification, or detailed description has been published at time of analysis.

Mbed TLS (mbedtls) on Alpine Linux has been patched in Alpine package version 4.1.1-r0 to address CVE-2026-50580. The nature of the underlying vulnerability - its class, impact, and exploitability - is not described in the available intelligence. The only confirmed data point is the existence of a fixed Alpine package; all other risk signals (CVSS, CWE, KEV, EPSS, POC) are absent, making independent risk assessment impossible without vendor disclosure.

mbedTLS on Alpine Linux received a security fix packaged as 4.1.1-r0 in the Alpine repository. The underlying vulnerability details - including attack vector, impact class, and affected mbedTLS upstream versions - are not disclosed in available intelligence sources. No CVSS score, CWE classification, or advisory narrative accompanies this entry; the sole confirmed fact is that Alpine Linux has patched the mbedTLS package at the 4.1.1-r0 Alpine package revision. Security teams using Alpine-based images or systems should treat this as an uncharacterized security fix requiring immediate package update pending further upstream disclosure.

Mbed TLS (mbedtls) received a security fix in Alpine Linux package version 4.1.1-r0, addressing an unspecified vulnerability. The nature of the flaw, affected upstream Mbed TLS version, and impact class are not disclosed in the available data - only the Alpine package fix version is confirmed. No CVSS score, CWE classification, or exploit information is available at time of analysis.

mbedTLS on Alpine Linux was patched in package version 4.1.1-r0, addressing an unspecified vulnerability in the TLS/SSL library. The underlying flaw, affected version range, and attack surface are not described in the available data - only the fix package version is confirmed. No CVSS score, CWE, or exploitation status has been published at time of analysis.

Mbed TLS in Alpine Linux received a security fix packaged as version 4.1.1-r0, addressing an unspecified vulnerability. The upstream nature, exploitability, and impact of this flaw cannot be determined from the available intelligence - no CVE description, CVSS vector, CWE classification, or vendor advisory details were provided. No public exploit and no CISA KEV listing have been identified at time of analysis.

Mbed TLS (mbedtls), the widely-used open-source TLS/SSL library, received a security fix in Alpine Linux packaged as version 4.1.1-r0. The nature of the underlying vulnerability - its type, impact, attack surface, and affected version range - is not disclosed in the available intelligence. No CVSS score, CWE classification, exploitation status, or vulnerability description has been published at time of analysis. Alpine Linux's vendor advisory constitutes the sole source for this CVE.

Mbed TLS (mbedtls) received a security fix in Alpine Linux package version 4.1.1-r0, addressing CVE-2026-54441. The nature of the underlying vulnerability - its impact class, attack vector, and exploitability - is not disclosed in the available intelligence. No CVSS score, CWE classification, or technical description has been published, making meaningful impact assessment impossible at this time. No public exploit has been identified and CISA KEV status is not confirmed.

Mbed TLS 3.x (mbedtls3) on Alpine Linux has been patched in Alpine package version 3.6.7-r0 to address CVE-2026-35336. The underlying vulnerability type, technical root cause, and exploitability details are not disclosed in currently available intelligence - only the Alpine Linux vendor advisory confirms a fix was issued. Security teams using Alpine Linux with mbedtls3 should treat this as requiring immediate patching given that cryptographic libraries commonly underpin TLS, certificate validation, and encryption across many dependent packages.

mbedtls3 on Alpine Linux received a security fix in package version 3.6.7-r0. The underlying vulnerability type, impact, and affected upstream MbedTLS version range are not described in the available CVE record - only the Alpine package fix version is confirmed. No exploitation status, CVSS score, or CWE classification has been assigned at time of analysis.

Mbed TLS 3.x on Alpine Linux received a security fix in package version 3.6.7-r0, addressing an unspecified vulnerability reported by the Alpine Linux vendor. The nature of the underlying flaw - whether cryptographic, memory safety, or protocol-level - is not disclosed in available intelligence. No exploit activity, CVSS scoring, or CWE classification is available at time of analysis, making independent risk assessment impossible without consulting the upstream Mbed TLS security advisory.

mbedtls3 on Alpine Linux received a security fix in package version 3.6.7-r0, addressing an unspecified vulnerability in the mbedTLS cryptographic library. The vulnerability details, including attack vector, impact class, and affected functionality, are not disclosed in the available intelligence. No CVSS score, CWE classification, or technical description was provided by the Alpine Linux vendor advisory beyond the package version bump.

Mbed TLS (mbedtls3) received a security fix in Alpine Linux package version 3.6.7-r0, addressing an unspecified vulnerability. The nature of the flaw - whether it affects cryptographic operations, TLS handshake processing, certificate validation, or another component - is not disclosed in the available intelligence. No CVSS score, CWE classification, or vulnerability description has been published, making independent risk assessment impossible at this time.

mbedTLS version 3.x (packaged as mbedtls3) on Alpine Linux contains a vulnerability addressed in Alpine package version 3.6.7-r0. The underlying vulnerability details - including attack vector, impact class, and exploitation requirements - are not disclosed in the available intelligence. The only confirmed fact is that Alpine Linux's vendor advisory identifies a fix in the mbedtls3 3.6.7-r0 package. No CVSS score, CWE classification, or exploit status is available at time of analysis.