Package · deb
curl
1 image ships it, in 1 version. Oldest version first. Search its versions.
Not covered
2 images have no package set in the report. Whether they ship this is unknown: amazonlinux:2023, debian:trixie-slim.
8.14.1-2+deb13u5
pkg:deb/debian/curl@8.14.1-2%2Bdeb13u5
| Image | Repository | Package list read from |
|---|---|---|
| debian-tools:latest | ghcr.io/northcutted/images/debian-tools | SBOM Verified. Found, and checked against a trusted signer in the policy. linux/amd64, linux/arm64 |
| Advisory | Severity | Fixed in | Images that count it | Suppressed in |
|---|---|---|---|---|
| CVE-2026-10536 | critical | no fix known | 1 | 0 |
| CVE-2026-11856 | critical | no fix known | 1 | 0 |
| CVE-2026-18924 | critical | no fix known | 1 | 0 |
| CVE-2026-19931 | critical | no fix known | 1 | 0 |
| CVE-2026-8924 | critical | no fix known | 1 | 0 |
| CVE-2026-8926 | critical | no fix known | 1 | 0 |
| CVE-2026-8927 | critical | no fix known | 1 | 0 |
| CVE-2026-9079 | critical | no fix known | 1 | 0 |
| CVE-2026-12064 | high | no fix known | 1 | 0 |
| CVE-2026-13608 | high | no fix known | 1 | 0 |
| CVE-2026-80229 | high | no fix known | 1 | 0 |
| CVE-2026-80230 | high | no fix known | 1 | 0 |
| CVE-2026-80255 | high | no fix known | 1 | 0 |
| CVE-2026-82209 | high | no fix known | 1 | 0 |
| CVE-2026-8286 | high | no fix known | 1 | 0 |
| CVE-2026-8932 | high | no fix known | 1 | 0 |
| CVE-2026-9080 | high | no fix known | 1 | 0 |
| CVE-2026-9545 | high | no fix known | 1 | 0 |
| CVE-2026-8458 | medium | no fix known | 1 | 0 |
| CVE-2025-10966 | negligible | no fix known | 1 | 0 |
| CVE-2025-14017 | negligible | no fix known | 1 | 0 |
| CVE-2025-15079 | negligible | no fix known | 1 | 0 |
| CVE-2025-15224 | negligible | no fix known | 1 | 0 |
| CVE-2026-82208 | negligible | no fix known | 1 | 0 |
| CVE-2026-9547 | negligible | no fix known | 1 | 0 |
Each image's package list was read from the evidence named, for the platform images listed (its packages are their union). Verified means a trusted signer vouched for all of it; anything else means some of it wasn't verified, so the list may not be complete. Not recorded means the report doesn't say where it came from.