kapsl Index
Docs Releases

python

1 tool · 6 release lines

CPython interpreter + standard library. Every tool here carries the same sandbox boundary.

kapsl python
Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises
  • stable — floats, carries security updates
  • unstable — tracks pre-releases, may break
  • eol — frozen, upstream is done

Tools in this project · pick one to inspect

all share one boundary

Tool Capabilities Seccomp Findings Image Description
showing python from python@latest → 3.14.7 stable python@3.14 → 3.14.7 stable python@3.13 → 3.13.15 stable python@3.12 → 3.12.14 stable python@3.11 → 3.11.16 stable python@3.10 → 3.10.21 stable

Findings

H10M24L1

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-66046 ↗ H 8.7 expat Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2)…
CVE-2026-76641 ↗ H 8.7 expat Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate.
CVE-2026-76642 ↗ H 8.5 util-linux util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-78408 ↗ H 7.9 util-linux The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve().
CVE-2026-76957 ↗ H 7.8 expat libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-78410 ↗ H 7.8 util-linux A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount.
CVE-2026-41080 ↗ H 7.5 expat libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-45186 ↗ H 7.5 expat In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-78409 ↗ H 7.0 util-linux The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW.
CVE-2026-56132 ↗ M 6.9 expat In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVE-2026-56403 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56404 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56406 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56407 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56408 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56410 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56411 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56409 ↗ M 6.5 expat xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-19672 ↗ M 6.3 python The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file.
CVE-2026-72522 ↗ M 6.2 expat libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
CVE-2026-15806 ↗ M 6.0 python The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a…
CVE-2026-17084 ↗ M 6.0 python The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0.
CVE-2025-15367 ↗ M 5.9 python The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVE-2026-50219 ↗ M 5.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
CVE-2026-56412 ↗ M 5.9 expat libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur.
CVE-2026-87910 ↗ M 5.7 python When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.
CVE-2025-66382 ↗ M 5.5 expat In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2026-32776 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 ↗ M 5.5 expat libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-56131 ↗ M 4.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-15310 ↗ L 2.1 python When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

These are the findings of python, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

H10M24L1

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-66046 ↗ H 8.7 expat Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2)…
CVE-2026-76641 ↗ H 8.7 expat Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate.
CVE-2026-76642 ↗ H 8.5 util-linux util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-78408 ↗ H 7.9 util-linux The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve().
CVE-2026-76957 ↗ H 7.8 expat libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-78410 ↗ H 7.8 util-linux A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount.
CVE-2026-41080 ↗ H 7.5 expat libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-45186 ↗ H 7.5 expat In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-78409 ↗ H 7.0 util-linux The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW.
CVE-2026-56132 ↗ M 6.9 expat In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVE-2026-56403 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56404 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56406 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56407 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56408 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56410 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56411 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56409 ↗ M 6.5 expat xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-19672 ↗ M 6.3 python The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file.
CVE-2026-72522 ↗ M 6.2 expat libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
CVE-2026-15806 ↗ M 6.0 python The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a…
CVE-2026-17084 ↗ M 6.0 python The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0.
CVE-2025-15367 ↗ M 5.9 python The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVE-2026-50219 ↗ M 5.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
CVE-2026-56412 ↗ M 5.9 expat libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur.
CVE-2026-87910 ↗ M 5.7 python When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.
CVE-2025-66382 ↗ M 5.5 expat In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2026-32776 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 ↗ M 5.5 expat libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-56131 ↗ M 4.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-15310 ↗ L 2.1 python When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

These are the findings of python, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

H10M24L1

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-66046 ↗ H 8.7 expat Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2)…
CVE-2026-76641 ↗ H 8.7 expat Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate.
CVE-2026-76642 ↗ H 8.5 util-linux util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-78408 ↗ H 7.9 util-linux The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve().
CVE-2026-76957 ↗ H 7.8 expat libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-78410 ↗ H 7.8 util-linux A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount.
CVE-2026-41080 ↗ H 7.5 expat libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-45186 ↗ H 7.5 expat In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-78409 ↗ H 7.0 util-linux The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW.
CVE-2026-56132 ↗ M 6.9 expat In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVE-2026-56403 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56404 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56406 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56407 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56408 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56410 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56411 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56409 ↗ M 6.5 expat xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-19672 ↗ M 6.3 python The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file.
CVE-2026-72522 ↗ M 6.2 expat libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
CVE-2026-15806 ↗ M 6.0 python The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a…
CVE-2026-17084 ↗ M 6.0 python The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0.
CVE-2025-15367 ↗ M 5.9 python The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVE-2026-50219 ↗ M 5.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
CVE-2026-56412 ↗ M 5.9 expat libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur.
CVE-2026-87910 ↗ M 5.7 python When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.
CVE-2025-66382 ↗ M 5.5 expat In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2026-32776 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 ↗ M 5.5 expat libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-56131 ↗ M 4.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-15310 ↗ L 2.1 python When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

These are the findings of python, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

H10M28L1?1

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-66046 ↗ H 8.7 expat Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2)…
CVE-2026-76641 ↗ H 8.7 expat Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate.
CVE-2026-76642 ↗ H 8.5 util-linux util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-78408 ↗ H 7.9 util-linux The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve().
CVE-2026-76957 ↗ H 7.8 expat libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-78410 ↗ H 7.8 util-linux A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount.
CVE-2026-41080 ↗ H 7.5 expat libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-45186 ↗ H 7.5 expat In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-78409 ↗ H 7.0 util-linux The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW.
CVE-2026-56132 ↗ M 6.9 expat In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVE-2026-56403 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56404 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56406 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56407 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56408 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56410 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56411 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56409 ↗ M 6.5 expat xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-19672 ↗ M 6.3 python The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file.
CVE-2026-72522 ↗ M 6.2 expat libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
CVE-2026-6019 ↗ M 6.1 python http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element.
CVE-2026-15806 ↗ M 6.0 python The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a…
CVE-2026-17084 ↗ M 6.0 python The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0.
CVE-2026-3446 ↗ M 6.0 python When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed.
CVE-2025-15366 ↗ M 5.9 python The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVE-2025-15367 ↗ M 5.9 python The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVE-2026-50219 ↗ M 5.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
CVE-2026-56412 ↗ M 5.9 expat libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur.
CVE-2026-87910 ↗ M 5.7 python When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.
CVE-2025-66382 ↗ M 5.5 expat In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2026-32776 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 ↗ M 5.5 expat libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2025-12781 ↗ M 5.3 python When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish…
CVE-2026-56131 ↗ M 4.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-15310 ↗ L 2.1 python When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
CVE-2026-3479 ↗ ? 0.0 python DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point.

These are the findings of python, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

H10M28L1?1

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-66046 ↗ H 8.7 expat Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2)…
CVE-2026-76641 ↗ H 8.7 expat Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate.
CVE-2026-76642 ↗ H 8.5 util-linux util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-78408 ↗ H 7.9 util-linux The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve().
CVE-2026-76957 ↗ H 7.8 expat libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-78410 ↗ H 7.8 util-linux A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount.
CVE-2026-41080 ↗ H 7.5 expat libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-45186 ↗ H 7.5 expat In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-78409 ↗ H 7.0 util-linux The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW.
CVE-2026-56132 ↗ M 6.9 expat In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVE-2026-56403 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56404 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56406 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56407 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56408 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56410 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56411 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56409 ↗ M 6.5 expat xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-19672 ↗ M 6.3 python The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file.
CVE-2026-72522 ↗ M 6.2 expat libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
CVE-2026-6019 ↗ M 6.1 python http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element.
CVE-2026-15806 ↗ M 6.0 python The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a…
CVE-2026-17084 ↗ M 6.0 python The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0.
CVE-2026-3446 ↗ M 6.0 python When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed.
CVE-2025-15366 ↗ M 5.9 python The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVE-2025-15367 ↗ M 5.9 python The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVE-2026-50219 ↗ M 5.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
CVE-2026-56412 ↗ M 5.9 expat libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur.
CVE-2026-87910 ↗ M 5.7 python When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.
CVE-2025-66382 ↗ M 5.5 expat In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2026-32776 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 ↗ M 5.5 expat libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2025-12781 ↗ M 5.3 python When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish…
CVE-2026-56131 ↗ M 4.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-15310 ↗ L 2.1 python When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
CVE-2026-3479 ↗ ? 0.0 python DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point.

These are the findings of python, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

H12M29L1?1

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-66046 ↗ H 8.7 expat Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2)…
CVE-2026-76641 ↗ H 8.7 expat Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate.
CVE-2026-76642 ↗ H 8.5 util-linux util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems.
CVE-2026-85091 ↗ H 8.3 zlib zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers.
CVE-2026-78408 ↗ H 7.9 util-linux The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve().
CVE-2026-76957 ↗ H 7.8 expat libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-78410 ↗ H 7.8 util-linux A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount.
CVE-2023-36632 ↗ H 7.5 python The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument.
CVE-2026-41080 ↗ H 7.5 expat libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-45186 ↗ H 7.5 expat In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-7210 ↗ H 7.5 python `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating…
CVE-2026-78409 ↗ H 7.0 util-linux The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW.
CVE-2026-56132 ↗ M 6.9 expat In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVE-2026-56403 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56404 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56406 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56407 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56408 ↗ M 6.9 expat libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56410 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56411 ↗ M 6.9 expat xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56409 ↗ M 6.5 expat xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-19672 ↗ M 6.3 python The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file.
CVE-2026-72522 ↗ M 6.2 expat libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
CVE-2026-6019 ↗ M 6.1 python http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element.
CVE-2026-15806 ↗ M 6.0 python The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a…
CVE-2026-17084 ↗ M 6.0 python The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0.
CVE-2026-3446 ↗ M 6.0 python When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to be processed.
CVE-2025-15366 ↗ M 5.9 python The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVE-2025-15367 ↗ M 5.9 python The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
CVE-2026-50219 ↗ M 5.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
CVE-2026-56412 ↗ M 5.9 expat libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur.
CVE-2026-87910 ↗ M 5.7 python When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive.
CVE-2025-66382 ↗ M 5.5 expat In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2026-32776 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 ↗ M 5.5 expat libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 ↗ M 5.5 expat libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2025-12781 ↗ M 5.3 python When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the "base64" module the characters "+/" will always be accepted, regardless of the value of "altchars" parameter, typically used to establish…
CVE-2026-12003 ↗ M 5.3 python To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local.
CVE-2026-56131 ↗ M 4.9 expat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVE-2026-39113 ↗ M 4.0 sqlite3 Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11)…
CVE-2026-15310 ↗ L 2.1 python When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.
CVE-2026-3479 ↗ ? 0.0 python DISPUTED: The project has clarified that the documentation was incorrect, and that pkgutil.get_data() has the same security model as open(). The documentation has been updated to clarify this point.

These are the findings of python, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Composition

default + env, bash
runtime none — self-contained
composes env, bash

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Image

name python
platforms
size 55 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name python
platforms
size 55 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name python
platforms
size 53 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name python
platforms
size 54 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name python
platforms
size 55 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Image

name python
platforms
size 48 MB unpacked · 1 layer
base scratch
signed cosign · · public key
findings last changed

Sandbox boundary

python

capabilities

rw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

host paths mounted in

read-only unless noted

  • ~/.python_history · writable

env passed through

11 forwarded

PYTHONDEVMODEPYTHONDONTWRITEBYTECODEPYTHONFAULTHANDLERPYTHONHASHSEEDPYTHONIOENCODINGPYTHONTRACEMALLOCPYTHONUNBUFFEREDPYTHONUTF8PYTHONWARNINGSPYTHON_COLORSPYTHON_CPU_COUNT

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

4 set

CPLUS_INCLUDE_PATHC_INCLUDE_PATHLIBRARY_PATHPKG_CONFIG_PATH

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

35 findings across this project at latest, 43 at 3.10 . Counted once per advisory across every image the project builds.