Skip to content

Weekly audit refresh: 39207650595 - #63

Open
github-actions[bot] wants to merge 1 commit into
mainfrom
chore/weekly-audit-refresh
Open

Weekly audit refresh: 39207650595#63
github-actions[bot] wants to merge 1 commit into
mainfrom
chore/weekly-audit-refresh

Conversation

@github-actions

@github-actions github-actions Bot commented Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CVE delta

Net change

Severity Added Removed Net
Critical 0 0 0
High 75 4 +71
Medium 269 75 +194
Low 144 6 +138

Changed images: 26 of 44

Per-image detail

adguard-adguardhome-v0.107.76

  • Added: C:0 H:1 M:4 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib

baserow-baserow-2.2.2

  • Added: C:0 H:2 M:6 L:19
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-92392 (HIGH) — curl
      • CVE-2026-59951 (MEDIUM) — mcp
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • CVE-2026-92388 (MEDIUM) — curl
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib
      • ...and 19 more

deluan-navidrome-0.61.2

  • Added: C:0 H:1 M:4 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib

docker.io-caddy-2.11.3

  • Added: C:0 H:1 M:4 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib

docker.io-library-postgres-18.4-alpine3.23

  • Added: C:0 H:0 M:4 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-78659 (MEDIUM) — stdlib
      • CVE-2026-78660 (MEDIUM) — stdlib
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib

docker.io-louislam-uptime-kuma-2.3.2

  • Added: C:0 H:51 M:19 L:17
  • Removed: C:0 H:0 M:6 L:2
    • [NEW]:
      • CVE-2026-110136 (HIGH) — chromium
      • CVE-2026-110137 (HIGH) — chromium
      • CVE-2026-110138 (HIGH) — chromium
      • CVE-2026-110139 (HIGH) — chromium
      • CVE-2026-110140 (HIGH) — chromium
      • CVE-2026-110141 (HIGH) — chromium
      • CVE-2026-110143 (HIGH) — chromium
      • CVE-2026-110144 (HIGH) — chromium
      • ...and 79 more
    • [FIXED]:
      • CVE-2026-47023 (MEDIUM) — libmariadb3
      • CVE-2026-60184 (MEDIUM) — libmariadb3
      • CVE-2026-60331 (MEDIUM) — libmariadb3
      • CVE-2026-60585 (MEDIUM) — libmariadb3
      • CVE-2026-60747 (MEDIUM) — libmariadb3
      • CVE-2026-97058 (MEDIUM) — sprintf-js
      • CVE-2026-106294 (LOW) — chromium
      • CVE-2026-61081 (LOW) — libmariadb3

docker.io-mariadb-12.2.2

  • Added: C:0 H:0 M:18 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-102473 (MEDIUM) — dash
      • CVE-2026-102474 (MEDIUM) — dash
      • CVE-2026-103111 (MEDIUM) — libpcre2-8-0
      • CVE-2026-67693 (MEDIUM) — libgnutls30t64
      • CVE-2026-78030 (MEDIUM) — libdbi-perl
      • CVE-2026-78659 (MEDIUM) — stdlib
      • CVE-2026-78660 (MEDIUM) — stdlib
      • CVE-2026-88647 (MEDIUM) — libgnutls30t64
      • ...and 10 more

docker.io-mongo-8.3.2

  • Added: C:0 H:1 M:17 L:9
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-102473 (MEDIUM) — dash
      • CVE-2026-102474 (MEDIUM) — dash
      • CVE-2026-103111 (MEDIUM) — libpcre2-8-0
      • CVE-2026-107161 (MEDIUM) — libsasl2-2
      • CVE-2026-67693 (MEDIUM) — libgnutls30t64
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • ...and 19 more

docuseal-docuseal-3.0.0

  • Added: C:0 H:1 M:1 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-77214 (HIGH) — libexpat
      • CVE-2026-102633 (MEDIUM) — libexpat

fnsys-dockhand-v1.0.29

  • Added: C:0 H:0 M:4 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-78659 (MEDIUM) — docker-cli-buildx
      • CVE-2026-78660 (MEDIUM) — docker-cli-buildx
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib

freshrss-freshrss-1.29.1-alpine

  • Added: C:0 H:1 M:1 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-77214 (HIGH) — libexpat
      • CVE-2026-102633 (MEDIUM) — libexpat

ghcr.io-goauthentik-server-2026.2.3

  • Added: C:0 H:4 M:24 L:37
  • Removed: C:0 H:1 M:0 L:1
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-92392 (HIGH) — curl
      • CVE-2026-98417 (HIGH) — linux-libc-dev
      • CVE-2026-99999 (HIGH) — linux-libc-dev
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • CVE-2026-92388 (MEDIUM) — curl
      • CVE-2026-94440 (MEDIUM) — stdlib
      • ...and 57 more
    • [FIXED]:
      • CVE-2026-89603 (HIGH) — linux-libc-dev
      • CVE-2026-93275 (LOW) — linux-libc-dev

ghcr.io-open-webui-open-webui-0.9.5

  • Added: C:0 H:4 M:22 L:32
  • Removed: C:0 H:3 M:6 L:2
    • [NEW]:
      • CVE-2026-86047 (HIGH) — libmariadb-dev
      • CVE-2026-97380 (HIGH) — libmariadb-dev
      • CVE-2026-98417 (HIGH) — linux-libc-dev
      • CVE-2026-99999 (HIGH) — linux-libc-dev
      • CVE-2026-104250 (MEDIUM) — unstructured
      • CVE-2026-59951 (MEDIUM) — mcp
      • CVE-2026-85231 (MEDIUM) — libtirpc-common
      • CVE-2026-85745 (MEDIUM) — libmariadb-dev
      • ...and 50 more
    • [FIXED]:
      • CVE-2026-15370 (HIGH) — libssh-gcrypt-4
      • CVE-2026-59849 (HIGH) — libssh-gcrypt-4
      • CVE-2026-89603 (HIGH) — linux-libc-dev
      • CVE-2026-47023 (MEDIUM) — libmariadb-dev
      • CVE-2026-60184 (MEDIUM) — libmariadb-dev
      • CVE-2026-60331 (MEDIUM) — libmariadb-dev
      • CVE-2026-60585 (MEDIUM) — libmariadb-dev
      • CVE-2026-60747 (MEDIUM) — libmariadb-dev
      • ...and 3 more

ghcr.io-stoatchat-livekit-server-v1.9.13

  • Added: C:0 H:1 M:4 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib

ghcr.io-wg-easy-wg-easy-15.3.0

  • Added: C:0 H:0 M:4 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib

ghcr.io-zulip-zulip-server-12.0-0

  • Added: C:0 H:1 M:72 L:9
  • Removed: C:0 H:0 M:62 L:1
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2025-40219 (MEDIUM) — linux-libc-dev
      • CVE-2026-102473 (MEDIUM) — dash
      • CVE-2026-102474 (MEDIUM) — dash
      • CVE-2026-103111 (MEDIUM) — libpcre2-8-0
      • CVE-2026-107161 (MEDIUM) — libsasl2-2
      • CVE-2026-62322 (MEDIUM) — social-auth-core
      • CVE-2026-67693 (MEDIUM) — libgnutls-dane0t64
      • ...and 74 more
    • [FIXED]:
      • CVE-2022-50332 (MEDIUM) — linux-libc-dev
      • CVE-2025-37855 (MEDIUM) — linux-libc-dev
      • CVE-2025-37877 (MEDIUM) — linux-libc-dev
      • CVE-2025-38033 (MEDIUM) — linux-libc-dev
      • CVE-2025-38047 (MEDIUM) — linux-libc-dev
      • CVE-2025-38070 (MEDIUM) — linux-libc-dev
      • CVE-2025-38168 (MEDIUM) — linux-libc-dev
      • CVE-2025-38329 (MEDIUM) — linux-libc-dev
      • ...and 55 more

lscr.io-linuxserver-jellyfin-10.11.9

  • Added: C:0 H:0 M:17 L:9
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-102473 (MEDIUM) — dash
      • CVE-2026-102474 (MEDIUM) — dash
      • CVE-2026-103111 (MEDIUM) — libpcre2-8-0
      • CVE-2026-107161 (MEDIUM) — libsasl2-2
      • CVE-2026-67693 (MEDIUM) — libgnutls30t64
      • CVE-2026-88647 (MEDIUM) — libgnutls30t64
      • CVE-2026-88806 (MEDIUM) — libx11-6
      • CVE-2026-89156 (MEDIUM) — libpcre2-8-0
      • ...and 18 more

mongo-8.3.2

  • Added: C:0 H:1 M:17 L:9
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-102473 (MEDIUM) — dash
      • CVE-2026-102474 (MEDIUM) — dash
      • CVE-2026-103111 (MEDIUM) — libpcre2-8-0
      • CVE-2026-107161 (MEDIUM) — libsasl2-2
      • CVE-2026-67693 (MEDIUM) — libgnutls30t64
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • ...and 19 more

n8nio-runners-2.22.1

  • Added: C:0 H:1 M:4 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-78659 (MEDIUM) — stdlib
      • CVE-2026-78660 (MEDIUM) — stdlib
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib

nextcloud-33.0.3-fpm-alpine

  • Added: C:0 H:1 M:1 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-77214 (HIGH) — libexpat
      • CVE-2026-102633 (MEDIUM) — libexpat

nginx-1.31.0-alpine3.23

  • Added: C:0 H:1 M:1 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-77214 (HIGH) — libexpat
      • CVE-2026-102633 (MEDIUM) — libexpat

postgres-18.4

  • Added: C:0 H:0 M:4 L:3
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-78659 (MEDIUM) — stdlib
      • CVE-2026-78660 (MEDIUM) — stdlib
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib
      • CVE-2026-95184 (LOW) — libgnutls30t64
      • CVE-2026-95209 (LOW) — libgnutls30t64
      • CVE-2026-95210 (LOW) — libgnutls30t64

qbittorrentofficial-qbittorrent-nox-5.2.0-1

  • Added: C:0 H:1 M:1 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-77214 (HIGH) — libexpat
      • CVE-2026-102633 (MEDIUM) — libexpat

rabbitmq-4.3.0

  • Added: C:0 H:0 M:12 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-102473 (MEDIUM) — dash
      • CVE-2026-102474 (MEDIUM) — dash
      • CVE-2026-103111 (MEDIUM) — libpcre2-8-0
      • CVE-2026-67693 (MEDIUM) — libgnutls30t64
      • CVE-2026-88647 (MEDIUM) — libgnutls30t64
      • CVE-2026-89156 (MEDIUM) — libpcre2-8-0
      • CVE-2026-89157 (MEDIUM) — libpcre2-8-0
      • CVE-2026-89158 (MEDIUM) — libpcre2-8-0
      • ...and 4 more

syncthing-syncthing-2.1.0

  • Added: C:0 H:1 M:4 L:0
  • Removed: C:0 H:0 M:0 L:0
    • [NEW]:
      • CVE-2026-56851 (HIGH) — golang.org/x/text
      • CVE-2026-78659 (MEDIUM) — golang.org/x/net
      • CVE-2026-78660 (MEDIUM) — golang.org/x/net
      • CVE-2026-94440 (MEDIUM) — stdlib
      • CVE-2026-97030 (MEDIUM) — stdlib

towfiqi-serpbear-3.1.0

  • Added: C:0 H:0 M:0 L:0
  • Removed: C:0 H:0 M:1 L:0
    • [FIXED]:
      • CVE-2026-97058 (MEDIUM) — sprintf-js

@github-actions
github-actions Bot enabled auto-merge (squash) June 15, 2026 07:46
@github-actions github-actions Bot changed the title Weekly audit refresh: 27531642510 Weekly audit refresh: 27937554468 Jun 22, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch 2 times, most recently from b731738 to ee0b4cb Compare June 29, 2026 07:31
@github-actions github-actions Bot changed the title Weekly audit refresh: 27937554468 Weekly audit refresh: 28355862242 Jun 29, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from ee0b4cb to f74a280 Compare July 6, 2026 07:24
@github-actions github-actions Bot changed the title Weekly audit refresh: 28355862242 Weekly audit refresh: 28774870590 Jul 6, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from f74a280 to dd640f5 Compare July 13, 2026 08:41
@github-actions github-actions Bot changed the title Weekly audit refresh: 28774870590 Weekly audit refresh: 29236242866 Jul 13, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from dd640f5 to bf5d844 Compare July 20, 2026 08:33
@github-actions github-actions Bot changed the title Weekly audit refresh: 29236242866 Weekly audit refresh: 29728216532 Jul 20, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from bf5d844 to 816e6d7 Compare July 27, 2026 09:22
@github-actions github-actions Bot changed the title Weekly audit refresh: 29728216532 Weekly audit refresh: 30253527123 Jul 27, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from 816e6d7 to 9cf054d Compare August 3, 2026 08:56
@github-actions github-actions Bot changed the title Weekly audit refresh: 30253527123 Weekly audit refresh: 30799210887 Aug 3, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from 9cf054d to ac8c576 Compare August 10, 2026 06:23
@github-actions github-actions Bot changed the title Weekly audit refresh: 30799210887 Weekly audit refresh: 31361726896 Aug 10, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from ac8c576 to 0cab591 Compare August 17, 2026 06:06
@github-actions github-actions Bot changed the title Weekly audit refresh: 31361726896 Weekly audit refresh: 32000254350 Aug 17, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from 0cab591 to 2cc93c5 Compare August 24, 2026 06:08
@github-actions github-actions Bot changed the title Weekly audit refresh: 32000254350 Weekly audit refresh: 32696049090 Aug 24, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from 2cc93c5 to 8ac450e Compare August 31, 2026 06:03
@github-actions github-actions Bot changed the title Weekly audit refresh: 32696049090 Weekly audit refresh: 33362608869 Aug 31, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from 8ac450e to a8821af Compare September 7, 2026 06:03
@github-actions github-actions Bot changed the title Weekly audit refresh: 33362608869 Weekly audit refresh: 34089089538 Sep 7, 2026
@wn-mira-org

wn-mira-org Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Mira PR Walkthrough

Refreshes the weekly security-audit documentation in AUDIT.md, replacing two lines without changing application code or dependencies. The accompanying report records CVE changes for 22 of 44 images, including net increases of four critical and eleven high findings; these are reported findings, not vulnerabilities introduced by this PR.

Confidence: 4/5   ◉◉◉◉○   Safe with minor verification
  • The documentation-only scope poses little merge risk, but the replacement text was not provided, so its consistency with the reported audit results still needs confirmation.

1 file reviewed

Comment @wn-mira-org help to get the list of available commands and usage tips.

wn-mira-org[bot]
wn-mira-org Bot reviewed Sep 7, 2026
View reviewed changes

@wn-mira-org wn-mira-org Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mira Review Summary

The audit refresh updates timestamps without updating the report to include the vulnerability delta described in the PR.

Key Issues

Issue Location
🔴 The new scan metadata labels an unchanged report despite the vulnerability changes reported in the PR description. AUDIT.md:5

Comment thread AUDIT.md Outdated
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from a8821af to e94ad9d Compare September 14, 2026 06:03
@github-actions github-actions Bot changed the title Weekly audit refresh: 34089089538 Weekly audit refresh: 34811804036 Sep 14, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from e94ad9d to eb61725 Compare September 21, 2026 06:03
@github-actions github-actions Bot changed the title Weekly audit refresh: 34811804036 Weekly audit refresh: 35566758050 Sep 21, 2026
@github-actions github-actions Bot changed the title Weekly audit refresh: 35566758050 Weekly audit refresh: 36384523311 Sep 28, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from eb61725 to f719dc1 Compare September 28, 2026 06:03
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from f719dc1 to d905692 Compare October 5, 2026 06:07
@github-actions github-actions Bot changed the title Weekly audit refresh: 36384523311 Weekly audit refresh: 37270779848 Oct 5, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from d905692 to 55f9185 Compare October 12, 2026 06:06
@github-actions github-actions Bot changed the title Weekly audit refresh: 37270779848 Weekly audit refresh: 38210857555 Oct 12, 2026
@github-actions
github-actions Bot force-pushed the chore/weekly-audit-refresh branch from 55f9185 to 261e07b Compare October 19, 2026 06:03
@github-actions github-actions Bot changed the title Weekly audit refresh: 38210857555 Weekly audit refresh: 39207650595 Oct 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wn-mira-org wn-mira-org[bot] wn-mira-org[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

audit automated

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@wnstfy