{
  "version": "2.1.0",
  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "grype",
          "version": "0.97.1",
          "informationUri": "https://github.com/anchore/grype",
          "rules": [
            {
              "id": "GHSA-5crp-9r3c-p9vr-Newtonsoft.Json",
              "name": "DotnetMatcherExactDirectMatch",
              "shortDescription": {
                "text": "GHSA-5crp-9r3c-p9vr high vulnerability for Newtonsoft.Json package"
              },
              "fullDescription": {
                "text": "Improper Handling of Exceptional Conditions in Newtonsoft.Json"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability GHSA-5crp-9r3c-p9vr\nSeverity: high\nPackage: Newtonsoft.Json\nVersion: 12.0.1\nFix Version: 13.0.1\nType: dotnet\nLocation: /app/BancoApi.deps.json\nData Namespace: github:language:dotnet\nLink: [GHSA-5crp-9r3c-p9vr](https://github.com/advisories/GHSA-5crp-9r3c-p9vr)",
                "markdown": "**Vulnerability GHSA-5crp-9r3c-p9vr**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | Newtonsoft.Json  | 12.0.1  | 13.0.1  | dotnet  | /app/BancoApi.deps.json  | github:language:dotnet  | [GHSA-5crp-9r3c-p9vr](https://github.com/advisories/GHSA-5crp-9r3c-p9vr)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:nuget/Newtonsoft.Json@12.0.1"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2011-3389-libgnutls30",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2011-3389 low vulnerability for libgnutls30 package"
              },
              "fullDescription": {
                "text": "The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2011-3389\nSeverity: low\nPackage: libgnutls30\nVersion: 3.7.9-2+deb12u7\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2011-3389](https://security-tracker.debian.org/tracker/CVE-2011-3389)",
                "markdown": "**Vulnerability CVE-2011-3389**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgnutls30  | 3.7.9-2+deb12u7  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2011-3389](https://security-tracker.debian.org/tracker/CVE-2011-3389)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u7?arch=amd64\u0026distro=debian-12\u0026upstream=gnutls28"
                ],
                "security-severity": "4.3"
              }
            },
            {
              "id": "CVE-2025-13151-libtasn1-6",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2025-13151 high vulnerability for libtasn1-6 package"
              },
              "fullDescription": {
                "text": "Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-13151\nSeverity: high\nPackage: libtasn1-6\nVersion: 4.19.0-2+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-13151](https://security-tracker.debian.org/tracker/CVE-2025-13151)",
                "markdown": "**Vulnerability CVE-2025-13151**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libtasn1-6  | 4.19.0-2+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-13151](https://security-tracker.debian.org/tracker/CVE-2025-13151)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libtasn1-6@4.19.0-2%2Bdeb12u1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2023-50495-libtinfo6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-50495 medium vulnerability for libtinfo6 package"
              },
              "fullDescription": {
                "text": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-50495\nSeverity: medium\nPackage: libtinfo6\nVersion: 6.4-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-50495](https://security-tracker.debian.org/tracker/CVE-2023-50495)",
                "markdown": "**Vulnerability CVE-2023-50495**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libtinfo6  | 6.4-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-50495](https://security-tracker.debian.org/tracker/CVE-2023-50495)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12\u0026upstream=ncurses"
                ],
                "security-severity": "6.5"
              }
            },
            {
              "id": "CVE-2023-50495-ncurses-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-50495 medium vulnerability for ncurses-base package"
              },
              "fullDescription": {
                "text": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-50495\nSeverity: medium\nPackage: ncurses-base\nVersion: 6.4-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-50495](https://security-tracker.debian.org/tracker/CVE-2023-50495)",
                "markdown": "**Vulnerability CVE-2023-50495**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | ncurses-base  | 6.4-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-50495](https://security-tracker.debian.org/tracker/CVE-2023-50495)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12\u0026upstream=ncurses"
                ],
                "security-severity": "6.5"
              }
            },
            {
              "id": "CVE-2023-50495-ncurses-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-50495 medium vulnerability for ncurses-bin package"
              },
              "fullDescription": {
                "text": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-50495\nSeverity: medium\nPackage: ncurses-bin\nVersion: 6.4-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-50495](https://security-tracker.debian.org/tracker/CVE-2023-50495)",
                "markdown": "**Vulnerability CVE-2023-50495**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | ncurses-bin  | 6.4-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-50495](https://security-tracker.debian.org/tracker/CVE-2023-50495)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12\u0026upstream=ncurses"
                ],
                "security-severity": "6.5"
              }
            },
            {
              "id": "CVE-2026-82560-perl-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-82560 high vulnerability for perl-base package"
              },
              "fullDescription": {
                "text": "Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.  Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.  Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-82560\nSeverity: high\nPackage: perl-base\nVersion: 5.36.0-7+deb12u4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-82560](https://security-tracker.debian.org/tracker/CVE-2026-82560)",
                "markdown": "**Vulnerability CVE-2026-82560**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | perl-base  | 5.36.0-7+deb12u4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-82560](https://security-tracker.debian.org/tracker/CVE-2026-82560)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u4?arch=amd64\u0026distro=debian-12\u0026upstream=perl"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2026-5450-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-5450 critical vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-5450\nSeverity: critical\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-5450](https://security-tracker.debian.org/tracker/CVE-2026-5450)",
                "markdown": "**Vulnerability CVE-2026-5450**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| critical  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-5450](https://security-tracker.debian.org/tracker/CVE-2026-5450)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "9.8"
              }
            },
            {
              "id": "CVE-2026-5450-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-5450 critical vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-5450\nSeverity: critical\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-5450](https://security-tracker.debian.org/tracker/CVE-2026-5450)",
                "markdown": "**Vulnerability CVE-2026-5450**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| critical  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-5450](https://security-tracker.debian.org/tracker/CVE-2026-5450)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "9.8"
              }
            },
            {
              "id": "CVE-2026-41992-gzip",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-41992 high vulnerability for gzip package"
              },
              "fullDescription": {
                "text": "GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.  This issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-41992\nSeverity: high\nPackage: gzip\nVersion: 1.12-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-41992](https://security-tracker.debian.org/tracker/CVE-2026-41992)",
                "markdown": "**Vulnerability CVE-2026-41992**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | gzip  | 1.12-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-41992](https://security-tracker.debian.org/tracker/CVE-2026-41992)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gzip@1.12-1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2026-76844-zlib1g",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-76844 high vulnerability for zlib1g package"
              },
              "fullDescription": {
                "text": "zlib 1.2.11 through 1.3.2 contains a heap buffer overflow: after an underlying write() fails, gz_write() returns without resetting strm.next_in, leaving it pointed at the caller's buffer. A later gz* write call then derives a position from the stale pointer and writes past a heap allocation; any write() failure reaches it, including EPIPE on a blocking descriptor, and in versions before 1.3.1.2 the failed write must be followed by a gzclearerr() call."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-76844\nSeverity: high\nPackage: zlib1g\nVersion: 1:1.2.13.dfsg-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-76844](https://security-tracker.debian.org/tracker/CVE-2026-76844)",
                "markdown": "**Vulnerability CVE-2026-76844**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | zlib1g  | 1:1.2.13.dfsg-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-76844](https://security-tracker.debian.org/tracker/CVE-2026-76844)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/zlib1g@1%3A1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12\u0026upstream=zlib"
                ],
                "security-severity": "7.4"
              }
            },
            {
              "id": "CVE-2026-9538-perl-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-9538 high vulnerability for perl-base package"
              },
              "fullDescription": {
                "text": "Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.  _read_tar() reads each entry's payload with $handle-\u003eread($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.  A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-9538\nSeverity: high\nPackage: perl-base\nVersion: 5.36.0-7+deb12u4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-9538](https://security-tracker.debian.org/tracker/CVE-2026-9538)",
                "markdown": "**Vulnerability CVE-2026-9538**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | perl-base  | 5.36.0-7+deb12u4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-9538](https://security-tracker.debian.org/tracker/CVE-2026-9538)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u4?arch=amd64\u0026distro=debian-12\u0026upstream=perl"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2026-85091-zlib1g",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-85091 high vulnerability for zlib1g package"
              },
              "fullDescription": {
                "text": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-85091\nSeverity: high\nPackage: zlib1g\nVersion: 1:1.2.13.dfsg-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)",
                "markdown": "**Vulnerability CVE-2026-85091**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | zlib1g  | 1:1.2.13.dfsg-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/zlib1g@1%3A1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12\u0026upstream=zlib"
                ],
                "security-severity": "8.3"
              }
            },
            {
              "id": "CVE-2026-95619-gcc-12-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95619 high vulnerability for gcc-12-base package"
              },
              "fullDescription": {
                "text": "A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95619\nSeverity: high\nPackage: gcc-12-base\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95619](https://security-tracker.debian.org/tracker/CVE-2026-95619)",
                "markdown": "**Vulnerability CVE-2026-95619**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | gcc-12-base  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95619](https://security-tracker.debian.org/tracker/CVE-2026-95619)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "7.7"
              }
            },
            {
              "id": "CVE-2026-95619-libgcc-s1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95619 high vulnerability for libgcc-s1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95619\nSeverity: high\nPackage: libgcc-s1\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95619](https://security-tracker.debian.org/tracker/CVE-2026-95619)",
                "markdown": "**Vulnerability CVE-2026-95619**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libgcc-s1  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95619](https://security-tracker.debian.org/tracker/CVE-2026-95619)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "7.7"
              }
            },
            {
              "id": "CVE-2026-95619-libstdc++6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95619 high vulnerability for libstdc++6 package"
              },
              "fullDescription": {
                "text": "A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95619\nSeverity: high\nPackage: libstdc++6\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95619](https://security-tracker.debian.org/tracker/CVE-2026-95619)",
                "markdown": "**Vulnerability CVE-2026-95619**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libstdc++6  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95619](https://security-tracker.debian.org/tracker/CVE-2026-95619)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "7.7"
              }
            },
            {
              "id": "CVE-2026-114691-gcc-12-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-114691 medium vulnerability for gcc-12-base package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector\u003cbool\u003e) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-114691\nSeverity: medium\nPackage: gcc-12-base\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-114691](https://security-tracker.debian.org/tracker/CVE-2026-114691)",
                "markdown": "**Vulnerability CVE-2026-114691**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | gcc-12-base  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-114691](https://security-tracker.debian.org/tracker/CVE-2026-114691)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "5.9"
              }
            },
            {
              "id": "CVE-2026-114691-libgcc-s1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-114691 medium vulnerability for libgcc-s1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector\u003cbool\u003e) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-114691\nSeverity: medium\nPackage: libgcc-s1\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-114691](https://security-tracker.debian.org/tracker/CVE-2026-114691)",
                "markdown": "**Vulnerability CVE-2026-114691**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libgcc-s1  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-114691](https://security-tracker.debian.org/tracker/CVE-2026-114691)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "5.9"
              }
            },
            {
              "id": "CVE-2026-114691-libstdc++6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-114691 medium vulnerability for libstdc++6 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector\u003cbool\u003e) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-114691\nSeverity: medium\nPackage: libstdc++6\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-114691](https://security-tracker.debian.org/tracker/CVE-2026-114691)",
                "markdown": "**Vulnerability CVE-2026-114691**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libstdc++6  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-114691](https://security-tracker.debian.org/tracker/CVE-2026-114691)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "5.9"
              }
            },
            {
              "id": "CVE-2025-69720-libtinfo6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-69720 high vulnerability for libtinfo6 package"
              },
              "fullDescription": {
                "text": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-69720\nSeverity: high\nPackage: libtinfo6\nVersion: 6.4-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-69720](https://security-tracker.debian.org/tracker/CVE-2025-69720)",
                "markdown": "**Vulnerability CVE-2025-69720**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libtinfo6  | 6.4-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-69720](https://security-tracker.debian.org/tracker/CVE-2025-69720)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12\u0026upstream=ncurses"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2025-69720-ncurses-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-69720 high vulnerability for ncurses-base package"
              },
              "fullDescription": {
                "text": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-69720\nSeverity: high\nPackage: ncurses-base\nVersion: 6.4-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-69720](https://security-tracker.debian.org/tracker/CVE-2025-69720)",
                "markdown": "**Vulnerability CVE-2025-69720**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | ncurses-base  | 6.4-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-69720](https://security-tracker.debian.org/tracker/CVE-2025-69720)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12\u0026upstream=ncurses"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2025-69720-ncurses-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-69720 high vulnerability for ncurses-bin package"
              },
              "fullDescription": {
                "text": "The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-69720\nSeverity: high\nPackage: ncurses-bin\nVersion: 6.4-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-69720](https://security-tracker.debian.org/tracker/CVE-2025-69720)",
                "markdown": "**Vulnerability CVE-2025-69720**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | ncurses-bin  | 6.4-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-69720](https://security-tracker.debian.org/tracker/CVE-2025-69720)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12\u0026upstream=ncurses"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2026-102010-gcc-12-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-102010 high vulnerability for gcc-12-base package"
              },
              "fullDescription": {
                "text": "A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-102010\nSeverity: high\nPackage: gcc-12-base\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-102010](https://security-tracker.debian.org/tracker/CVE-2026-102010)",
                "markdown": "**Vulnerability CVE-2026-102010**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | gcc-12-base  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-102010](https://security-tracker.debian.org/tracker/CVE-2026-102010)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-102010-libgcc-s1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-102010 high vulnerability for libgcc-s1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-102010\nSeverity: high\nPackage: libgcc-s1\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-102010](https://security-tracker.debian.org/tracker/CVE-2026-102010)",
                "markdown": "**Vulnerability CVE-2026-102010**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libgcc-s1  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-102010](https://security-tracker.debian.org/tracker/CVE-2026-102010)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-102010-libstdc++6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-102010 high vulnerability for libstdc++6 package"
              },
              "fullDescription": {
                "text": "A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-102010\nSeverity: high\nPackage: libstdc++6\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-102010](https://security-tracker.debian.org/tracker/CVE-2026-102010)",
                "markdown": "**Vulnerability CVE-2026-102010**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libstdc++6  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-102010](https://security-tracker.debian.org/tracker/CVE-2026-102010)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2018-20796-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2018-20796 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2018-20796\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2018-20796](https://security-tracker.debian.org/tracker/CVE-2018-20796)",
                "markdown": "**Vulnerability CVE-2018-20796**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2018-20796](https://security-tracker.debian.org/tracker/CVE-2018-20796)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2018-20796-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2018-20796 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2018-20796\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2018-20796](https://security-tracker.debian.org/tracker/CVE-2018-20796)",
                "markdown": "**Vulnerability CVE-2018-20796**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2018-20796](https://security-tracker.debian.org/tracker/CVE-2018-20796)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2026-5928-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-5928 high vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.  A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp-\u003e_IO_read_ptr) instead of the actual wide-stream read pointer (fp-\u003e_wide_data-\u003e_IO_read_ptr). The program crash may happen in cases where fp-\u003e_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-5928\nSeverity: high\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-5928](https://security-tracker.debian.org/tracker/CVE-2026-5928)",
                "markdown": "**Vulnerability CVE-2026-5928**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-5928](https://security-tracker.debian.org/tracker/CVE-2026-5928)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2026-5928-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-5928 high vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.  A bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp-\u003e_IO_read_ptr) instead of the actual wide-stream read pointer (fp-\u003e_wide_data-\u003e_IO_read_ptr). The program crash may happen in cases where fp-\u003e_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-5928\nSeverity: high\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-5928](https://security-tracker.debian.org/tracker/CVE-2026-5928)",
                "markdown": "**Vulnerability CVE-2026-5928**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-5928](https://security-tracker.debian.org/tracker/CVE-2026-5928)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2026-5704-tar",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-5704 medium vulnerability for tar package"
              },
              "fullDescription": {
                "text": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-5704\nSeverity: medium\nPackage: tar\nVersion: 1.34+dfsg-1.2+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-5704](https://security-tracker.debian.org/tracker/CVE-2026-5704)",
                "markdown": "**Vulnerability CVE-2026-5704**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | tar  | 1.34+dfsg-1.2+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-5704](https://security-tracker.debian.org/tracker/CVE-2026-5704)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2026-3184-bsdutils",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-3184 medium vulnerability for bsdutils package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-3184\nSeverity: medium\nPackage: bsdutils\nVersion: 1:2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)",
                "markdown": "**Vulnerability CVE-2026-3184**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | bsdutils  | 1:2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/bsdutils@1%3A2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux%402.38.1-5%2Bdeb12u3"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-3184-libblkid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-3184 medium vulnerability for libblkid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-3184\nSeverity: medium\nPackage: libblkid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)",
                "markdown": "**Vulnerability CVE-2026-3184**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libblkid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-3184-libmount1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-3184 medium vulnerability for libmount1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-3184\nSeverity: medium\nPackage: libmount1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)",
                "markdown": "**Vulnerability CVE-2026-3184**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libmount1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-3184-libsmartcols1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-3184 medium vulnerability for libsmartcols1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-3184\nSeverity: medium\nPackage: libsmartcols1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)",
                "markdown": "**Vulnerability CVE-2026-3184**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libsmartcols1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-3184-libuuid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-3184 medium vulnerability for libuuid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-3184\nSeverity: medium\nPackage: libuuid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)",
                "markdown": "**Vulnerability CVE-2026-3184**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libuuid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-3184-mount",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-3184 medium vulnerability for mount package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-3184\nSeverity: medium\nPackage: mount\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)",
                "markdown": "**Vulnerability CVE-2026-3184**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | mount  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-3184-util-linux",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-3184 medium vulnerability for util-linux package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-3184\nSeverity: medium\nPackage: util-linux\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)",
                "markdown": "**Vulnerability CVE-2026-3184**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | util-linux  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-3184-util-linux-extra",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-3184 medium vulnerability for util-linux-extra package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-3184\nSeverity: medium\nPackage: util-linux-extra\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)",
                "markdown": "**Vulnerability CVE-2026-3184**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | util-linux-extra  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-3184](https://security-tracker.debian.org/tracker/CVE-2026-3184)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-19499-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-19499 high vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.  Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.  At the time of publication, no network-facing application impact is known."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-19499\nSeverity: high\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-19499](https://security-tracker.debian.org/tracker/CVE-2026-19499)",
                "markdown": "**Vulnerability CVE-2026-19499**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-19499](https://security-tracker.debian.org/tracker/CVE-2026-19499)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.7"
              }
            },
            {
              "id": "CVE-2026-19499-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-19499 high vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.  Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.  At the time of publication, no network-facing application impact is known."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-19499\nSeverity: high\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-19499](https://security-tracker.debian.org/tracker/CVE-2026-19499)",
                "markdown": "**Vulnerability CVE-2026-19499**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-19499](https://security-tracker.debian.org/tracker/CVE-2026-19499)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.7"
              }
            },
            {
              "id": "CVE-2026-84243-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-84243 high vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.  The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.  LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-84243\nSeverity: high\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-84243](https://security-tracker.debian.org/tracker/CVE-2026-84243)",
                "markdown": "**Vulnerability CVE-2026-84243**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-84243](https://security-tracker.debian.org/tracker/CVE-2026-84243)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-84243-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-84243 high vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to \"..\", unless the program is setuid or setgid (AT_SECURE).  An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system.  A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program.  That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program.  The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this.  The fix for CVE-2014-0475 rejects \"..\" path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables.  gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE.  LANGUAGE is only used when the LC_MESSAGES locale is not \"C\", \"C.\u003cencoding\u003e\" or \"POSIX\", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL.  Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE.  An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-84243\nSeverity: high\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-84243](https://security-tracker.debian.org/tracker/CVE-2026-84243)",
                "markdown": "**Vulnerability CVE-2026-84243**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-84243](https://security-tracker.debian.org/tracker/CVE-2026-84243)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-6238-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-6238 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.  These functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-6238\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-6238](https://security-tracker.debian.org/tracker/CVE-2026-6238)",
                "markdown": "**Vulnerability CVE-2026-6238**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-6238](https://security-tracker.debian.org/tracker/CVE-2026-6238)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "6.5"
              }
            },
            {
              "id": "CVE-2026-6238-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-6238 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.  These functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-6238\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-6238](https://security-tracker.debian.org/tracker/CVE-2026-6238)",
                "markdown": "**Vulnerability CVE-2026-6238**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-6238](https://security-tracker.debian.org/tracker/CVE-2026-6238)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "6.5"
              }
            },
            {
              "id": "CVE-2005-2541-tar",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2005-2541 low vulnerability for tar package"
              },
              "fullDescription": {
                "text": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2005-2541\nSeverity: low\nPackage: tar\nVersion: 1.34+dfsg-1.2+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2005-2541](https://security-tracker.debian.org/tracker/CVE-2005-2541)",
                "markdown": "**Vulnerability CVE-2005-2541**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | tar  | 1.34+dfsg-1.2+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2005-2541](https://security-tracker.debian.org/tracker/CVE-2005-2541)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "10.0"
              }
            },
            {
              "id": "CVE-2026-77117-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-77117 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-77117\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-77117](https://security-tracker.debian.org/tracker/CVE-2026-77117)",
                "markdown": "**Vulnerability CVE-2026-77117**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-77117](https://security-tracker.debian.org/tracker/CVE-2026-77117)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.9"
              }
            },
            {
              "id": "CVE-2026-80489-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-80489 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-80489\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-80489](https://security-tracker.debian.org/tracker/CVE-2026-80489)",
                "markdown": "**Vulnerability CVE-2026-80489**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-80489](https://security-tracker.debian.org/tracker/CVE-2026-80489)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.9"
              }
            },
            {
              "id": "CVE-2026-77117-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-77117 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-77117\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-77117](https://security-tracker.debian.org/tracker/CVE-2026-77117)",
                "markdown": "**Vulnerability CVE-2026-77117**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-77117](https://security-tracker.debian.org/tracker/CVE-2026-77117)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.9"
              }
            },
            {
              "id": "CVE-2026-80489-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-80489 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.  Some EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-80489\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-80489](https://security-tracker.debian.org/tracker/CVE-2026-80489)",
                "markdown": "**Vulnerability CVE-2026-80489**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-80489](https://security-tracker.debian.org/tracker/CVE-2026-80489)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.9"
              }
            },
            {
              "id": "CVE-2026-54411-libpam-modules",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-54411 medium vulnerability for libpam-modules package"
              },
              "fullDescription": {
                "text": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-54411\nSeverity: medium\nPackage: libpam-modules\nVersion: 1.5.2-6+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-54411](https://security-tracker.debian.org/tracker/CVE-2026-54411)",
                "markdown": "**Vulnerability CVE-2026-54411**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libpam-modules  | 1.5.2-6+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-54411](https://security-tracker.debian.org/tracker/CVE-2026-54411)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libpam-modules@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=pam"
                ],
                "security-severity": "6.9"
              }
            },
            {
              "id": "CVE-2026-54411-libpam-modules-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-54411 medium vulnerability for libpam-modules-bin package"
              },
              "fullDescription": {
                "text": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-54411\nSeverity: medium\nPackage: libpam-modules-bin\nVersion: 1.5.2-6+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-54411](https://security-tracker.debian.org/tracker/CVE-2026-54411)",
                "markdown": "**Vulnerability CVE-2026-54411**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libpam-modules-bin  | 1.5.2-6+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-54411](https://security-tracker.debian.org/tracker/CVE-2026-54411)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libpam-modules-bin@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=pam"
                ],
                "security-severity": "6.9"
              }
            },
            {
              "id": "CVE-2026-54411-libpam-runtime",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-54411 medium vulnerability for libpam-runtime package"
              },
              "fullDescription": {
                "text": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-54411\nSeverity: medium\nPackage: libpam-runtime\nVersion: 1.5.2-6+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-54411](https://security-tracker.debian.org/tracker/CVE-2026-54411)",
                "markdown": "**Vulnerability CVE-2026-54411**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libpam-runtime  | 1.5.2-6+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-54411](https://security-tracker.debian.org/tracker/CVE-2026-54411)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libpam-runtime@1.5.2-6%2Bdeb12u2?arch=all\u0026distro=debian-12\u0026upstream=pam"
                ],
                "security-severity": "6.9"
              }
            },
            {
              "id": "CVE-2026-54411-libpam0g",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-54411 medium vulnerability for libpam0g package"
              },
              "fullDescription": {
                "text": "Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-54411\nSeverity: medium\nPackage: libpam0g\nVersion: 1.5.2-6+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-54411](https://security-tracker.debian.org/tracker/CVE-2026-54411)",
                "markdown": "**Vulnerability CVE-2026-54411**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libpam0g  | 1.5.2-6+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-54411](https://security-tracker.debian.org/tracker/CVE-2026-54411)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libpam0g@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=pam"
                ],
                "security-severity": "6.9"
              }
            },
            {
              "id": "CVE-2026-5435-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-5435 high vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-5435\nSeverity: high\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-5435](https://security-tracker.debian.org/tracker/CVE-2026-5435)",
                "markdown": "**Vulnerability CVE-2026-5435**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-5435](https://security-tracker.debian.org/tracker/CVE-2026-5435)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.3"
              }
            },
            {
              "id": "CVE-2026-5435-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-5435 high vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-5435\nSeverity: high\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-5435](https://security-tracker.debian.org/tracker/CVE-2026-5435)",
                "markdown": "**Vulnerability CVE-2026-5435**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-5435](https://security-tracker.debian.org/tracker/CVE-2026-5435)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.3"
              }
            },
            {
              "id": "CVE-2019-1010022-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-1010022 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-1010022\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-1010022](https://security-tracker.debian.org/tracker/CVE-2019-1010022)",
                "markdown": "**Vulnerability CVE-2019-1010022**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-1010022](https://security-tracker.debian.org/tracker/CVE-2019-1010022)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "9.8"
              }
            },
            {
              "id": "CVE-2019-1010022-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-1010022 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-1010022\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-1010022](https://security-tracker.debian.org/tracker/CVE-2019-1010022)",
                "markdown": "**Vulnerability CVE-2019-1010022**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-1010022](https://security-tracker.debian.org/tracker/CVE-2019-1010022)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "9.8"
              }
            },
            {
              "id": "CVE-2026-8674-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-8674 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.  The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-8674\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-8674](https://security-tracker.debian.org/tracker/CVE-2026-8674)",
                "markdown": "**Vulnerability CVE-2026-8674**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-8674](https://security-tracker.debian.org/tracker/CVE-2026-8674)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-8674-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-8674 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.  The resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-8674\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-8674](https://security-tracker.debian.org/tracker/CVE-2026-8674)",
                "markdown": "**Vulnerability CVE-2026-8674**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-8674](https://security-tracker.debian.org/tracker/CVE-2026-8674)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2019-1010024-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-1010024 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-1010024\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-1010024](https://security-tracker.debian.org/tracker/CVE-2019-1010024)",
                "markdown": "**Vulnerability CVE-2019-1010024**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-1010024](https://security-tracker.debian.org/tracker/CVE-2019-1010024)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2019-1010024-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-1010024 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-1010024\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-1010024](https://security-tracker.debian.org/tracker/CVE-2019-1010024)",
                "markdown": "**Vulnerability CVE-2019-1010024**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-1010024](https://security-tracker.debian.org/tracker/CVE-2019-1010024)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2019-1010023-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-1010023 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-1010023\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-1010023](https://security-tracker.debian.org/tracker/CVE-2019-1010023)",
                "markdown": "**Vulnerability CVE-2019-1010023**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-1010023](https://security-tracker.debian.org/tracker/CVE-2019-1010023)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "8.8"
              }
            },
            {
              "id": "CVE-2019-1010023-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-1010023 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-1010023\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-1010023](https://security-tracker.debian.org/tracker/CVE-2019-1010023)",
                "markdown": "**Vulnerability CVE-2019-1010023**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-1010023](https://security-tracker.debian.org/tracker/CVE-2019-1010023)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "8.8"
              }
            },
            {
              "id": "CVE-2026-78410-bsdutils",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-78410 high vulnerability for bsdutils package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-78410\nSeverity: high\nPackage: bsdutils\nVersion: 1:2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)",
                "markdown": "**Vulnerability CVE-2026-78410**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | bsdutils  | 1:2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/bsdutils@1%3A2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux%402.38.1-5%2Bdeb12u3"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2026-78410-libblkid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-78410 high vulnerability for libblkid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-78410\nSeverity: high\nPackage: libblkid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)",
                "markdown": "**Vulnerability CVE-2026-78410**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libblkid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2026-78410-libmount1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-78410 high vulnerability for libmount1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-78410\nSeverity: high\nPackage: libmount1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)",
                "markdown": "**Vulnerability CVE-2026-78410**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libmount1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2026-78410-libsmartcols1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-78410 high vulnerability for libsmartcols1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-78410\nSeverity: high\nPackage: libsmartcols1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)",
                "markdown": "**Vulnerability CVE-2026-78410**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libsmartcols1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2026-78410-libuuid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-78410 high vulnerability for libuuid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-78410\nSeverity: high\nPackage: libuuid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)",
                "markdown": "**Vulnerability CVE-2026-78410**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libuuid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2026-78410-mount",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-78410 high vulnerability for mount package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-78410\nSeverity: high\nPackage: mount\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)",
                "markdown": "**Vulnerability CVE-2026-78410**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | mount  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2026-78410-util-linux",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-78410 high vulnerability for util-linux package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-78410\nSeverity: high\nPackage: util-linux\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)",
                "markdown": "**Vulnerability CVE-2026-78410**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | util-linux  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2026-78410-util-linux-extra",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-78410 high vulnerability for util-linux-extra package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-78410\nSeverity: high\nPackage: util-linux-extra\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)",
                "markdown": "**Vulnerability CVE-2026-78410**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | util-linux-extra  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-78410](https://security-tracker.debian.org/tracker/CVE-2026-78410)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.8"
              }
            },
            {
              "id": "CVE-2024-56433-login",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2024-56433 low vulnerability for login package"
              },
              "fullDescription": {
                "text": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2024-56433\nSeverity: low\nPackage: login\nVersion: 1:4.13+dfsg1-1+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2024-56433](https://security-tracker.debian.org/tracker/CVE-2024-56433)",
                "markdown": "**Vulnerability CVE-2024-56433**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | login  | 1:4.13+dfsg1-1+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2024-56433](https://security-tracker.debian.org/tracker/CVE-2024-56433)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/login@1%3A4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=shadow"
                ],
                "security-severity": "3.6"
              }
            },
            {
              "id": "CVE-2024-56433-passwd",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2024-56433 low vulnerability for passwd package"
              },
              "fullDescription": {
                "text": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2024-56433\nSeverity: low\nPackage: passwd\nVersion: 1:4.13+dfsg1-1+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2024-56433](https://security-tracker.debian.org/tracker/CVE-2024-56433)",
                "markdown": "**Vulnerability CVE-2024-56433**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | passwd  | 1:4.13+dfsg1-1+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2024-56433](https://security-tracker.debian.org/tracker/CVE-2024-56433)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/passwd@1%3A4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=shadow"
                ],
                "security-severity": "3.6"
              }
            },
            {
              "id": "CVE-2026-53615-bsdutils",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53615 high vulnerability for bsdutils package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53615\nSeverity: high\nPackage: bsdutils\nVersion: 1:2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)",
                "markdown": "**Vulnerability CVE-2026-53615**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | bsdutils  | 1:2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/bsdutils@1%3A2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux%402.38.1-5%2Bdeb12u3"
                ],
                "security-severity": "8.0"
              }
            },
            {
              "id": "CVE-2026-53615-libblkid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53615 high vulnerability for libblkid1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53615\nSeverity: high\nPackage: libblkid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)",
                "markdown": "**Vulnerability CVE-2026-53615**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libblkid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "8.0"
              }
            },
            {
              "id": "CVE-2026-53615-libmount1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53615 high vulnerability for libmount1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53615\nSeverity: high\nPackage: libmount1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)",
                "markdown": "**Vulnerability CVE-2026-53615**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libmount1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "8.0"
              }
            },
            {
              "id": "CVE-2026-53615-libsmartcols1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53615 high vulnerability for libsmartcols1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53615\nSeverity: high\nPackage: libsmartcols1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)",
                "markdown": "**Vulnerability CVE-2026-53615**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libsmartcols1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "8.0"
              }
            },
            {
              "id": "CVE-2026-53615-libuuid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53615 high vulnerability for libuuid1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53615\nSeverity: high\nPackage: libuuid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)",
                "markdown": "**Vulnerability CVE-2026-53615**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libuuid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "8.0"
              }
            },
            {
              "id": "CVE-2026-53615-mount",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53615 high vulnerability for mount package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53615\nSeverity: high\nPackage: mount\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)",
                "markdown": "**Vulnerability CVE-2026-53615**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | mount  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "8.0"
              }
            },
            {
              "id": "CVE-2026-53615-util-linux",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53615 high vulnerability for util-linux package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53615\nSeverity: high\nPackage: util-linux\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)",
                "markdown": "**Vulnerability CVE-2026-53615**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | util-linux  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "8.0"
              }
            },
            {
              "id": "CVE-2026-53615-util-linux-extra",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53615 high vulnerability for util-linux-extra package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53615\nSeverity: high\nPackage: util-linux-extra\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)",
                "markdown": "**Vulnerability CVE-2026-53615**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | util-linux-extra  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53615](https://security-tracker.debian.org/tracker/CVE-2026-53615)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "8.0"
              }
            },
            {
              "id": "CVE-2010-4756-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2010-4756 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2010-4756\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2010-4756](https://security-tracker.debian.org/tracker/CVE-2010-4756)",
                "markdown": "**Vulnerability CVE-2010-4756**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2010-4756](https://security-tracker.debian.org/tracker/CVE-2010-4756)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "4.0"
              }
            },
            {
              "id": "CVE-2010-4756-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2010-4756 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2010-4756\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2010-4756](https://security-tracker.debian.org/tracker/CVE-2010-4756)",
                "markdown": "**Vulnerability CVE-2010-4756**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2010-4756](https://security-tracker.debian.org/tracker/CVE-2010-4756)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "4.0"
              }
            },
            {
              "id": "CVE-2026-27171-zlib1g",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-27171 medium vulnerability for zlib1g package"
              },
              "fullDescription": {
                "text": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-27171\nSeverity: medium\nPackage: zlib1g\nVersion: 1:1.2.13.dfsg-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-27171](https://security-tracker.debian.org/tracker/CVE-2026-27171)",
                "markdown": "**Vulnerability CVE-2026-27171**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | zlib1g  | 1:1.2.13.dfsg-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-27171](https://security-tracker.debian.org/tracker/CVE-2026-27171)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/zlib1g@1%3A1.2.13.dfsg-1?arch=amd64\u0026distro=debian-12\u0026upstream=zlib"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2026-115819-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-115819 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.  These conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.  The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-115819\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-115819](https://security-tracker.debian.org/tracker/CVE-2026-115819)",
                "markdown": "**Vulnerability CVE-2026-115819**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-115819](https://security-tracker.debian.org/tracker/CVE-2026-115819)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "4.8"
              }
            },
            {
              "id": "CVE-2026-115819-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-115819 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[ conversion without the 'l' length modifier in the GNU C Library version 2.2 to version 2.44 writes an extra null byte one past the end of the destination array when the converted multibyte string and its terminating null byte exactly fill that array.  These conversions store each wide input character into the caller's char array as a multibyte sequence.  The conversion ends with the sequence that returns to the initial shift state, which also stores the terminating null byte, and the functions then append a second null byte.  A destination sized for the converted string and one terminator, as the C standard requires the caller to provide, is therefore written one byte past its end.  The out-of-bounds byte is always a null byte, which may corrupt adjacent data or crash the process.  An attacker who supplies the input can trigger the overflow with a string whose converted length exactly fills the destination.  The narrow scanf functions, the %ls and %l[ conversions into a wchar_t array, and the 'a' and 'm' allocation modifiers are not affected, and storing a wide scanf conversion into a narrow char array is uncommon.  This issue affects all architectures and ABIs supported by the GNU C Library."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-115819\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-115819](https://security-tracker.debian.org/tracker/CVE-2026-115819)",
                "markdown": "**Vulnerability CVE-2026-115819**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-115819](https://security-tracker.debian.org/tracker/CVE-2026-115819)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "4.8"
              }
            },
            {
              "id": "CVE-2024-10041-libpam-modules",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2024-10041 medium vulnerability for libpam-modules package"
              },
              "fullDescription": {
                "text": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2024-10041\nSeverity: medium\nPackage: libpam-modules\nVersion: 1.5.2-6+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2024-10041](https://security-tracker.debian.org/tracker/CVE-2024-10041)",
                "markdown": "**Vulnerability CVE-2024-10041**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libpam-modules  | 1.5.2-6+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2024-10041](https://security-tracker.debian.org/tracker/CVE-2024-10041)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libpam-modules@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=pam"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2024-10041-libpam-modules-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2024-10041 medium vulnerability for libpam-modules-bin package"
              },
              "fullDescription": {
                "text": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2024-10041\nSeverity: medium\nPackage: libpam-modules-bin\nVersion: 1.5.2-6+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2024-10041](https://security-tracker.debian.org/tracker/CVE-2024-10041)",
                "markdown": "**Vulnerability CVE-2024-10041**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libpam-modules-bin  | 1.5.2-6+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2024-10041](https://security-tracker.debian.org/tracker/CVE-2024-10041)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libpam-modules-bin@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=pam"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2024-10041-libpam-runtime",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2024-10041 medium vulnerability for libpam-runtime package"
              },
              "fullDescription": {
                "text": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2024-10041\nSeverity: medium\nPackage: libpam-runtime\nVersion: 1.5.2-6+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2024-10041](https://security-tracker.debian.org/tracker/CVE-2024-10041)",
                "markdown": "**Vulnerability CVE-2024-10041**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libpam-runtime  | 1.5.2-6+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2024-10041](https://security-tracker.debian.org/tracker/CVE-2024-10041)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libpam-runtime@1.5.2-6%2Bdeb12u2?arch=all\u0026distro=debian-12\u0026upstream=pam"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2024-10041-libpam0g",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2024-10041 medium vulnerability for libpam0g package"
              },
              "fullDescription": {
                "text": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2024-10041\nSeverity: medium\nPackage: libpam0g\nVersion: 1.5.2-6+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2024-10041](https://security-tracker.debian.org/tracker/CVE-2024-10041)",
                "markdown": "**Vulnerability CVE-2024-10041**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libpam0g  | 1.5.2-6+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2024-10041](https://security-tracker.debian.org/tracker/CVE-2024-10041)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libpam0g@1.5.2-6%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=pam"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2016-2781-coreutils",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2016-2781 low vulnerability for coreutils package"
              },
              "fullDescription": {
                "text": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2016-2781\nSeverity: low\nPackage: coreutils\nVersion: 9.1-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2016-2781](https://security-tracker.debian.org/tracker/CVE-2016-2781)",
                "markdown": "**Vulnerability CVE-2016-2781**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | coreutils  | 9.1-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2016-2781](https://security-tracker.debian.org/tracker/CVE-2016-2781)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "6.5"
              }
            },
            {
              "id": "CVE-2026-6791-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-6791 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-6791\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-6791](https://security-tracker.debian.org/tracker/CVE-2026-6791)",
                "markdown": "**Vulnerability CVE-2026-6791**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-6791](https://security-tracker.debian.org/tracker/CVE-2026-6791)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "6.6"
              }
            },
            {
              "id": "CVE-2026-6791-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-6791 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-6791\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-6791](https://security-tracker.debian.org/tracker/CVE-2026-6791)",
                "markdown": "**Vulnerability CVE-2026-6791**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-6791](https://security-tracker.debian.org/tracker/CVE-2026-6791)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "6.6"
              }
            },
            {
              "id": "CVE-2019-1010025-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-1010025 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-1010025\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-1010025](https://security-tracker.debian.org/tracker/CVE-2019-1010025)",
                "markdown": "**Vulnerability CVE-2019-1010025**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-1010025](https://security-tracker.debian.org/tracker/CVE-2019-1010025)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2019-1010025-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-1010025 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-1010025\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-1010025](https://security-tracker.debian.org/tracker/CVE-2019-1010025)",
                "markdown": "**Vulnerability CVE-2019-1010025**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-1010025](https://security-tracker.debian.org/tracker/CVE-2019-1010025)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2019-9192-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-9192 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-9192\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-9192](https://security-tracker.debian.org/tracker/CVE-2019-9192)",
                "markdown": "**Vulnerability CVE-2019-9192**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-9192](https://security-tracker.debian.org/tracker/CVE-2019-9192)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2019-9192-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2019-9192 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2019-9192\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2019-9192](https://security-tracker.debian.org/tracker/CVE-2019-9192)",
                "markdown": "**Vulnerability CVE-2019-9192**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2019-9192](https://security-tracker.debian.org/tracker/CVE-2019-9192)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2026-19542-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-19542 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.  The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-19542\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-19542](https://security-tracker.debian.org/tracker/CVE-2026-19542)",
                "markdown": "**Vulnerability CVE-2026-19542**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-19542](https://security-tracker.debian.org/tracker/CVE-2026-19542)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.6"
              }
            },
            {
              "id": "CVE-2026-19542-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-19542 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.  The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-19542\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-19542](https://security-tracker.debian.org/tracker/CVE-2026-19542)",
                "markdown": "**Vulnerability CVE-2026-19542**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-19542](https://security-tracker.debian.org/tracker/CVE-2026-19542)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "5.6"
              }
            },
            {
              "id": "CVE-2026-53613-bsdutils",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53613 high vulnerability for bsdutils package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53613\nSeverity: high\nPackage: bsdutils\nVersion: 1:2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)",
                "markdown": "**Vulnerability CVE-2026-53613**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | bsdutils  | 1:2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/bsdutils@1%3A2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux%402.38.1-5%2Bdeb12u3"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-53613-libblkid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53613 high vulnerability for libblkid1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53613\nSeverity: high\nPackage: libblkid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)",
                "markdown": "**Vulnerability CVE-2026-53613**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libblkid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-53613-libmount1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53613 high vulnerability for libmount1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53613\nSeverity: high\nPackage: libmount1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)",
                "markdown": "**Vulnerability CVE-2026-53613**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libmount1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-53613-libsmartcols1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53613 high vulnerability for libsmartcols1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53613\nSeverity: high\nPackage: libsmartcols1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)",
                "markdown": "**Vulnerability CVE-2026-53613**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libsmartcols1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-53613-libuuid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53613 high vulnerability for libuuid1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53613\nSeverity: high\nPackage: libuuid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)",
                "markdown": "**Vulnerability CVE-2026-53613**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libuuid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-53613-mount",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53613 high vulnerability for mount package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53613\nSeverity: high\nPackage: mount\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)",
                "markdown": "**Vulnerability CVE-2026-53613**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | mount  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-53613-util-linux",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53613 high vulnerability for util-linux package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53613\nSeverity: high\nPackage: util-linux\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)",
                "markdown": "**Vulnerability CVE-2026-53613**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | util-linux  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-53613-util-linux-extra",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53613 high vulnerability for util-linux-extra package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53613\nSeverity: high\nPackage: util-linux-extra\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)",
                "markdown": "**Vulnerability CVE-2026-53613**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | util-linux-extra  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53613](https://security-tracker.debian.org/tracker/CVE-2026-53613)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "7.0"
              }
            },
            {
              "id": "CVE-2026-100290-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-100290 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.  An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-100290\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-100290](https://security-tracker.debian.org/tracker/CVE-2026-100290)",
                "markdown": "**Vulnerability CVE-2026-100290**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-100290](https://security-tracker.debian.org/tracker/CVE-2026-100290)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "3.7"
              }
            },
            {
              "id": "CVE-2026-100290-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-100290 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.  An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-100290\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-100290](https://security-tracker.debian.org/tracker/CVE-2026-100290)",
                "markdown": "**Vulnerability CVE-2026-100290**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-100290](https://security-tracker.debian.org/tracker/CVE-2026-100290)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "3.7"
              }
            },
            {
              "id": "CVE-2026-54369-libacl1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-54369 high vulnerability for libacl1 package"
              },
              "fullDescription": {
                "text": "acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-54369\nSeverity: high\nPackage: libacl1\nVersion: 2.3.1-3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)",
                "markdown": "**Vulnerability CVE-2026-54369**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libacl1  | 2.3.1-3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libacl1@2.3.1-3?arch=amd64\u0026distro=debian-12\u0026upstream=acl"
                ],
                "security-severity": "7.1"
              }
            },
            {
              "id": "CVE-2026-89092-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-89092 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a  stack overflow when a malicious DNS server returns too large a response  for a DNS query, resulting in degraded DNS resolution for the system.    Exploitation of this bug needs a system that has nscd enabled and using  an untrusted DNS server for name resolution, with the compromised DNS  server being capable of processing records large enough to result in a  stack overflow in an nscd thread stack.  During experimentation, bind 9  was unable to handle large records, but that could change in future or  with a different name server.  In typical installations, nscd is  executed in an isolated context as its own user without a shell, due to  which any compromise of that service is isolated.    There is a remote possibility of nscd cache corruption if an attacker  manages to get the stack pointer into a desired point in the heap,  potentially resulting in other caches in nscd being overwritten with  corrupt data through the stack overflow, until the buggy code path  eventually results in a crash.    Finally, a crash in nscd may result in performance degradation when  resolving names, but it does not result in a denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-89092\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-89092](https://security-tracker.debian.org/tracker/CVE-2026-89092)",
                "markdown": "**Vulnerability CVE-2026-89092**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-89092](https://security-tracker.debian.org/tracker/CVE-2026-89092)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "4.2"
              }
            },
            {
              "id": "CVE-2026-89092-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-89092 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "The nscd service in the GNU C Library 2.3.4 onwards may crash due to a  stack overflow when a malicious DNS server returns too large a response  for a DNS query, resulting in degraded DNS resolution for the system.    Exploitation of this bug needs a system that has nscd enabled and using  an untrusted DNS server for name resolution, with the compromised DNS  server being capable of processing records large enough to result in a  stack overflow in an nscd thread stack.  During experimentation, bind 9  was unable to handle large records, but that could change in future or  with a different name server.  In typical installations, nscd is  executed in an isolated context as its own user without a shell, due to  which any compromise of that service is isolated.    There is a remote possibility of nscd cache corruption if an attacker  manages to get the stack pointer into a desired point in the heap,  potentially resulting in other caches in nscd being overwritten with  corrupt data through the stack overflow, until the buggy code path  eventually results in a crash.    Finally, a crash in nscd may result in performance degradation when  resolving names, but it does not result in a denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-89092\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-89092](https://security-tracker.debian.org/tracker/CVE-2026-89092)",
                "markdown": "**Vulnerability CVE-2026-89092**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-89092](https://security-tracker.debian.org/tracker/CVE-2026-89092)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "4.2"
              }
            },
            {
              "id": "CVE-2026-95692-libssl3",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95692 low vulnerability for libssl3 package"
              },
              "fullDescription": {
                "text": "Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected.  Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV.  CWE: CWE-125: Out-of-bounds Read  Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length.  The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery.  Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application.  FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95692\nSeverity: low\nPackage: libssl3\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95692](https://security-tracker.debian.org/tracker/CVE-2026-95692)",
                "markdown": "**Vulnerability CVE-2026-95692**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libssl3  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95692](https://security-tracker.debian.org/tracker/CVE-2026-95692)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libssl3@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=openssl"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-95692-openssl",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95692 low vulnerability for openssl package"
              },
              "fullDescription": {
                "text": "Issue summary: Setting an AES-GCM-SIV IV shorter than the expected nonce length via EVP_CipherInit_ex() may trigger a heap out-of-bounds read. Supplying a longer IV is silently truncated instead of rejected.  Impact summary: An application passing a caller-supplied IV of the wrong length may crash or read beyond its buffer. Because trailing IV bytes are ignored, an attacker who knows one message and tag may forge messages under a different IV.  CWE: CWE-125: Out-of-bounds Read  Description: AES-GCM-SIV copies the caller-supplied IV or nonce into its internal state using a copy whose length is taken from the expected nonce size rather than from the length the caller actually provided. When the caller passes a shorter IV, the copy reads past the end of the caller's buffer; AddressSanitizer confirms a heap out-of-bounds read reached through EVP_CipherInit_ex() into ossl_aes_gcm_siv_init(). When the caller passes a longer IV, the implementation silently discards the trailing bytes instead of rejecting the length.  The truncation breaks the binding between the IV and the computed authentication tag. An attacker who has observed a message and its tag under one IV can produce a message and tag that verify under a different IV whose first bytes match, since the surplus bytes never influence the computation. The message itself is unchanged, so this is a failure of IV commitment rather than a classic existential forgery.  Only applications that call EVP_CipherInit_ex() (or the equivalent provider cipher initialization) with an IV length other than the standard 12 bytes for AES-GCM-SIV are affected. The severity is limited because the out-of-bounds read is small and attacker-controlled only in length, and the forgery requires an unusual IV length choice by the application.  FIPS impact: no The FIPS modules are not affected by this issue, as AES-GCM-SIV is not an approved algorithm."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95692\nSeverity: low\nPackage: openssl\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95692](https://security-tracker.debian.org/tracker/CVE-2026-95692)",
                "markdown": "**Vulnerability CVE-2026-95692**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | openssl  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95692](https://security-tracker.debian.org/tracker/CVE-2026-95692)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/openssl@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-115456-gcc-12-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-115456 low vulnerability for gcc-12-base package"
              },
              "fullDescription": {
                "text": "A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-115456\nSeverity: low\nPackage: gcc-12-base\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-115456](https://security-tracker.debian.org/tracker/CVE-2026-115456)",
                "markdown": "**Vulnerability CVE-2026-115456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | gcc-12-base  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-115456](https://security-tracker.debian.org/tracker/CVE-2026-115456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "3.7"
              }
            },
            {
              "id": "CVE-2026-115456-libgcc-s1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-115456 low vulnerability for libgcc-s1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-115456\nSeverity: low\nPackage: libgcc-s1\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-115456](https://security-tracker.debian.org/tracker/CVE-2026-115456)",
                "markdown": "**Vulnerability CVE-2026-115456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgcc-s1  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-115456](https://security-tracker.debian.org/tracker/CVE-2026-115456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "3.7"
              }
            },
            {
              "id": "CVE-2026-115456-libstdc++6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-115456 low vulnerability for libstdc++6 package"
              },
              "fullDescription": {
                "text": "A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-115456\nSeverity: low\nPackage: libstdc++6\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-115456](https://security-tracker.debian.org/tracker/CVE-2026-115456)",
                "markdown": "**Vulnerability CVE-2026-115456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libstdc++6  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-115456](https://security-tracker.debian.org/tracker/CVE-2026-115456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "3.7"
              }
            },
            {
              "id": "CVE-2025-6141-libtinfo6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-6141 medium vulnerability for libtinfo6 package"
              },
              "fullDescription": {
                "text": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-6141\nSeverity: medium\nPackage: libtinfo6\nVersion: 6.4-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-6141](https://security-tracker.debian.org/tracker/CVE-2025-6141)",
                "markdown": "**Vulnerability CVE-2025-6141**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libtinfo6  | 6.4-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-6141](https://security-tracker.debian.org/tracker/CVE-2025-6141)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libtinfo6@6.4-4?arch=amd64\u0026distro=debian-12\u0026upstream=ncurses"
                ],
                "security-severity": "4.8"
              }
            },
            {
              "id": "CVE-2025-6141-ncurses-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-6141 medium vulnerability for ncurses-base package"
              },
              "fullDescription": {
                "text": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-6141\nSeverity: medium\nPackage: ncurses-base\nVersion: 6.4-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-6141](https://security-tracker.debian.org/tracker/CVE-2025-6141)",
                "markdown": "**Vulnerability CVE-2025-6141**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | ncurses-base  | 6.4-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-6141](https://security-tracker.debian.org/tracker/CVE-2025-6141)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/ncurses-base@6.4-4?arch=all\u0026distro=debian-12\u0026upstream=ncurses"
                ],
                "security-severity": "4.8"
              }
            },
            {
              "id": "CVE-2025-6141-ncurses-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-6141 medium vulnerability for ncurses-bin package"
              },
              "fullDescription": {
                "text": "A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-6141\nSeverity: medium\nPackage: ncurses-bin\nVersion: 6.4-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-6141](https://security-tracker.debian.org/tracker/CVE-2025-6141)",
                "markdown": "**Vulnerability CVE-2025-6141**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | ncurses-bin  | 6.4-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-6141](https://security-tracker.debian.org/tracker/CVE-2025-6141)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/ncurses-bin@6.4-4?arch=amd64\u0026distro=debian-12\u0026upstream=ncurses"
                ],
                "security-severity": "4.8"
              }
            },
            {
              "id": "CVE-2026-88822-libssl3",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-88822 low vulnerability for libssl3 package"
              },
              "fullDescription": {
                "text": "Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets.  Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic.  CWE: CWE-457 (Use of Uninitialized Variable)  Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake.  This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers.  FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-88822\nSeverity: low\nPackage: libssl3\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-88822](https://security-tracker.debian.org/tracker/CVE-2026-88822)",
                "markdown": "**Vulnerability CVE-2026-88822**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libssl3  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-88822](https://security-tracker.debian.org/tracker/CVE-2026-88822)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libssl3@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=openssl"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-88822-openssl",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-88822 low vulnerability for openssl package"
              },
              "fullDescription": {
                "text": "Issue summary: QUIC, when performing automated peer detection, may allow uninitialized stack data to leak into the received address which is then used as the destination for outgoing packets.  Impact summary: Applications using QUIC's automated peer detection mechanism may receive an invalid address, leading to connection loss and disclosure of uninitialized stack data to an attacker observing the outgoing network traffic.  CWE: CWE-457 (Use of Uninitialized Variable)  Description: The OpenSSL QUIC stack contains a feature in which, when using an already connected socket, it will auto-detect the peer address during the SSL handshake.  This feature uses the getpeername() function, passing a buffer of sufficient length to hold any supported address family, but passes a buffer length that is only sized such that larger addresses, such as IPv6, cannot be retrieved. The getpeername() function however, still returns the full address length, which is accepted as the valid input buffer length, leading to the address buffer containing uninitialized stack data instead of the actual peer address. The invalid peer address is then used as destination for the outgoing packets which leads to a connectivity breakage and a leakage of the uninitialized stack data to passive network observers.  FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected protocol is not implemented in the FIPS module."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-88822\nSeverity: low\nPackage: openssl\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-88822](https://security-tracker.debian.org/tracker/CVE-2026-88822)",
                "markdown": "**Vulnerability CVE-2026-88822**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | openssl  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-88822](https://security-tracker.debian.org/tracker/CVE-2026-88822)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/openssl@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-95691-libssl3",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95691 low vulnerability for libssl3 package"
              },
              "fullDescription": {
                "text": "Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer retains a direct pointer into that storage causing use after free.  Impact summary: A malicious QUIC server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one allocator-adjacent byte through the client's protected Handshake response.  CWE: CWE-416: Use After Free  Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is lent to the TLS handshake processing. The memory must remain stable until it is processed and released. However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake processing continues.  The use-after-free read can lead to a Denial-of-Service of the client application or a minor leak of information about the heap memory contents that might be overwritten with other data, subsequently allocated by the application, to the peer.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95691\nSeverity: low\nPackage: libssl3\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95691](https://security-tracker.debian.org/tracker/CVE-2026-95691)",
                "markdown": "**Vulnerability CVE-2026-95691**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libssl3  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95691](https://security-tracker.debian.org/tracker/CVE-2026-95691)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libssl3@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=openssl"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-95691-openssl",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95691 low vulnerability for openssl package"
              },
              "fullDescription": {
                "text": "Issue summary: A retransmitted QUIC CRYPTO frame can release packet storage while the TLS record layer retains a direct pointer into that storage causing use after free.  Impact summary: A malicious QUIC server can cause a heap-use-after-free read in the OpenSSL QUIC client. The server can also identify one allocator-adjacent byte through the client's protected Handshake response.  CWE: CWE-416: Use After Free  Description: During CRYPTO stream processing, a pointer into the first frame's memory on the stream is lent to the TLS handshake processing. The memory must remain stable until it is processed and released. However the processing of retransmitted CRYPTO frames could release the memory if the retransmitted frame fully overlapped the existing frame. This then causes use-after-free read when the TLS handshake processing continues.  The use-after-free read can lead to a Denial-of-Service of the client application or a minor leak of information about the heap memory contents that might be overwritten with other data, subsequently allocated by the application, to the peer.  FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95691\nSeverity: low\nPackage: openssl\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95691](https://security-tracker.debian.org/tracker/CVE-2026-95691)",
                "markdown": "**Vulnerability CVE-2026-95691**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | openssl  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95691](https://security-tracker.debian.org/tracker/CVE-2026-95691)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/openssl@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-97399-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-97399 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.  This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-97399\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-97399](https://security-tracker.debian.org/tracker/CVE-2026-97399)",
                "markdown": "**Vulnerability CVE-2026-97399**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-97399](https://security-tracker.debian.org/tracker/CVE-2026-97399)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "3.7"
              }
            },
            {
              "id": "CVE-2026-97399-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-97399 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.  This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-97399\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-97399](https://security-tracker.debian.org/tracker/CVE-2026-97399)",
                "markdown": "**Vulnerability CVE-2026-97399**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-97399](https://security-tracker.debian.org/tracker/CVE-2026-97399)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "3.7"
              }
            },
            {
              "id": "CVE-2025-30258-gpgv",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-30258 medium vulnerability for gpgv package"
              },
              "fullDescription": {
                "text": "In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\""
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-30258\nSeverity: medium\nPackage: gpgv\nVersion: 2.2.40-1.1+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-30258](https://security-tracker.debian.org/tracker/CVE-2025-30258)",
                "markdown": "**Vulnerability CVE-2025-30258**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | gpgv  | 2.2.40-1.1+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-30258](https://security-tracker.debian.org/tracker/CVE-2025-30258)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=gnupg2"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2018-6829-libgcrypt20",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2018-6829 low vulnerability for libgcrypt20 package"
              },
              "fullDescription": {
                "text": "cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2018-6829\nSeverity: low\nPackage: libgcrypt20\nVersion: 1.10.1-3+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2018-6829](https://security-tracker.debian.org/tracker/CVE-2018-6829)",
                "markdown": "**Vulnerability CVE-2018-6829**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgcrypt20  | 1.10.1-3+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2018-6829](https://security-tracker.debian.org/tracker/CVE-2018-6829)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgcrypt20@1.10.1-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "7.5"
              }
            },
            {
              "id": "CVE-2026-15534-perl-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-15534 medium vulnerability for perl-base package"
              },
              "fullDescription": {
                "text": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.  The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.  A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-15534\nSeverity: medium\nPackage: perl-base\nVersion: 5.36.0-7+deb12u4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-15534](https://security-tracker.debian.org/tracker/CVE-2026-15534)",
                "markdown": "**Vulnerability CVE-2026-15534**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | perl-base  | 5.36.0-7+deb12u4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-15534](https://security-tracker.debian.org/tracker/CVE-2026-15534)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u4?arch=amd64\u0026distro=debian-12\u0026upstream=perl"
                ],
                "security-severity": "5.7"
              }
            },
            {
              "id": "CVE-2023-31486-perl-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-31486 low vulnerability for perl-base package"
              },
              "fullDescription": {
                "text": "HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-31486\nSeverity: low\nPackage: perl-base\nVersion: 5.36.0-7+deb12u4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-31486](https://security-tracker.debian.org/tracker/CVE-2023-31486)",
                "markdown": "**Vulnerability CVE-2023-31486**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | perl-base  | 5.36.0-7+deb12u4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-31486](https://security-tracker.debian.org/tracker/CVE-2023-31486)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u4?arch=amd64\u0026distro=debian-12\u0026upstream=perl"
                ],
                "security-severity": "8.1"
              }
            },
            {
              "id": "CVE-2026-13757-libp11-kit0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-13757 medium vulnerability for libp11-kit0 package"
              },
              "fullDescription": {
                "text": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-13757\nSeverity: medium\nPackage: libp11-kit0\nVersion: 0.24.1-2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-13757](https://security-tracker.debian.org/tracker/CVE-2026-13757)",
                "markdown": "**Vulnerability CVE-2026-13757**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libp11-kit0  | 0.24.1-2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-13757](https://security-tracker.debian.org/tracker/CVE-2026-13757)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=amd64\u0026distro=debian-12\u0026upstream=p11-kit"
                ],
                "security-severity": "6.2"
              }
            },
            {
              "id": "CVE-2026-15059-libsystemd0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-15059 medium vulnerability for libsystemd0 package"
              },
              "fullDescription": {
                "text": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-15059\nSeverity: medium\nPackage: libsystemd0\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-15059](https://security-tracker.debian.org/tracker/CVE-2026-15059)",
                "markdown": "**Vulnerability CVE-2026-15059**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libsystemd0  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-15059](https://security-tracker.debian.org/tracker/CVE-2026-15059)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2026-15059-libudev1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-15059 medium vulnerability for libudev1 package"
              },
              "fullDescription": {
                "text": "Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-15059\nSeverity: medium\nPackage: libudev1\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-15059](https://security-tracker.debian.org/tracker/CVE-2026-15059)",
                "markdown": "**Vulnerability CVE-2026-15059**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libudev1  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-15059](https://security-tracker.debian.org/tracker/CVE-2026-15059)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2026-54371-libattr1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-54371 medium vulnerability for libattr1 package"
              },
              "fullDescription": {
                "text": "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-54371\nSeverity: medium\nPackage: libattr1\nVersion: 1:2.5.1-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)",
                "markdown": "**Vulnerability CVE-2026-54371**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libattr1  | 1:2.5.1-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libattr1@1%3A2.5.1-4?arch=amd64\u0026distro=debian-12\u0026upstream=attr"
                ],
                "security-severity": "6.3"
              }
            },
            {
              "id": "CVE-2026-27456-bsdutils",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-27456 medium vulnerability for bsdutils package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-27456\nSeverity: medium\nPackage: bsdutils\nVersion: 1:2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)",
                "markdown": "**Vulnerability CVE-2026-27456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | bsdutils  | 1:2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/bsdutils@1%3A2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux%402.38.1-5%2Bdeb12u3"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-27456-libblkid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-27456 medium vulnerability for libblkid1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-27456\nSeverity: medium\nPackage: libblkid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)",
                "markdown": "**Vulnerability CVE-2026-27456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libblkid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-27456-libmount1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-27456 medium vulnerability for libmount1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-27456\nSeverity: medium\nPackage: libmount1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)",
                "markdown": "**Vulnerability CVE-2026-27456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libmount1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-27456-libsmartcols1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-27456 medium vulnerability for libsmartcols1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-27456\nSeverity: medium\nPackage: libsmartcols1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)",
                "markdown": "**Vulnerability CVE-2026-27456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libsmartcols1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-27456-libuuid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-27456 medium vulnerability for libuuid1 package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-27456\nSeverity: medium\nPackage: libuuid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)",
                "markdown": "**Vulnerability CVE-2026-27456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libuuid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-27456-mount",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-27456 medium vulnerability for mount package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-27456\nSeverity: medium\nPackage: mount\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)",
                "markdown": "**Vulnerability CVE-2026-27456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | mount  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-27456-util-linux",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-27456 medium vulnerability for util-linux package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-27456\nSeverity: medium\nPackage: util-linux\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)",
                "markdown": "**Vulnerability CVE-2026-27456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | util-linux  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-27456-util-linux-extra",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-27456 medium vulnerability for util-linux-extra package"
              },
              "fullDescription": {
                "text": "util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-27456\nSeverity: medium\nPackage: util-linux-extra\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)",
                "markdown": "**Vulnerability CVE-2026-27456**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | util-linux-extra  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-27456](https://security-tracker.debian.org/tracker/CVE-2026-27456)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-13595-bsdutils",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-13595 medium vulnerability for bsdutils package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-13595\nSeverity: medium\nPackage: bsdutils\nVersion: 1:2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)",
                "markdown": "**Vulnerability CVE-2026-13595**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | bsdutils  | 1:2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/bsdutils@1%3A2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux%402.38.1-5%2Bdeb12u3"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-13595-libblkid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-13595 medium vulnerability for libblkid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-13595\nSeverity: medium\nPackage: libblkid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)",
                "markdown": "**Vulnerability CVE-2026-13595**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libblkid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-13595-libmount1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-13595 medium vulnerability for libmount1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-13595\nSeverity: medium\nPackage: libmount1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)",
                "markdown": "**Vulnerability CVE-2026-13595**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libmount1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-13595-libsmartcols1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-13595 medium vulnerability for libsmartcols1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-13595\nSeverity: medium\nPackage: libsmartcols1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)",
                "markdown": "**Vulnerability CVE-2026-13595**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libsmartcols1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-13595-libuuid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-13595 medium vulnerability for libuuid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-13595\nSeverity: medium\nPackage: libuuid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)",
                "markdown": "**Vulnerability CVE-2026-13595**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libuuid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-13595-mount",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-13595 medium vulnerability for mount package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-13595\nSeverity: medium\nPackage: mount\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)",
                "markdown": "**Vulnerability CVE-2026-13595**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | mount  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-13595-util-linux",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-13595 medium vulnerability for util-linux package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-13595\nSeverity: medium\nPackage: util-linux\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)",
                "markdown": "**Vulnerability CVE-2026-13595**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | util-linux  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-13595-util-linux-extra",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-13595 medium vulnerability for util-linux-extra package"
              },
              "fullDescription": {
                "text": "A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-13595\nSeverity: medium\nPackage: util-linux-extra\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)",
                "markdown": "**Vulnerability CVE-2026-13595**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | util-linux-extra  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-13595](https://security-tracker.debian.org/tracker/CVE-2026-13595)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2026-114690-gcc-12-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-114690 medium vulnerability for gcc-12-base package"
              },
              "fullDescription": {
                "text": "A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-114690\nSeverity: medium\nPackage: gcc-12-base\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-114690](https://security-tracker.debian.org/tracker/CVE-2026-114690)",
                "markdown": "**Vulnerability CVE-2026-114690**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | gcc-12-base  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-114690](https://security-tracker.debian.org/tracker/CVE-2026-114690)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "6.2"
              }
            },
            {
              "id": "CVE-2026-114690-libgcc-s1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-114690 medium vulnerability for libgcc-s1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-114690\nSeverity: medium\nPackage: libgcc-s1\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-114690](https://security-tracker.debian.org/tracker/CVE-2026-114690)",
                "markdown": "**Vulnerability CVE-2026-114690**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libgcc-s1  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-114690](https://security-tracker.debian.org/tracker/CVE-2026-114690)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "6.2"
              }
            },
            {
              "id": "CVE-2026-114690-libstdc++6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-114690 medium vulnerability for libstdc++6 package"
              },
              "fullDescription": {
                "text": "A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS)."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-114690\nSeverity: medium\nPackage: libstdc++6\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-114690](https://security-tracker.debian.org/tracker/CVE-2026-114690)",
                "markdown": "**Vulnerability CVE-2026-114690**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libstdc++6  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-114690](https://security-tracker.debian.org/tracker/CVE-2026-114690)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "6.2"
              }
            },
            {
              "id": "CVE-2026-18374-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-18374 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.    This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-18374\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-18374](https://security-tracker.debian.org/tracker/CVE-2026-18374)",
                "markdown": "**Vulnerability CVE-2026-18374**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-18374](https://security-tracker.debian.org/tracker/CVE-2026-18374)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "4.9"
              }
            },
            {
              "id": "CVE-2026-18374-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-18374 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled.    This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-18374\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-18374](https://security-tracker.debian.org/tracker/CVE-2026-18374)",
                "markdown": "**Vulnerability CVE-2026-18374**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-18374](https://security-tracker.debian.org/tracker/CVE-2026-18374)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "4.9"
              }
            },
            {
              "id": "CVE-2026-88823-libssl3",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-88823 low vulnerability for libssl3 package"
              },
              "fullDescription": {
                "text": "Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment.  Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message.  CWE: CWE-325: Missing Cryptographic Step  Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message.  The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD.  FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-88823\nSeverity: low\nPackage: libssl3\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-88823](https://security-tracker.debian.org/tracker/CVE-2026-88823)",
                "markdown": "**Vulnerability CVE-2026-88823**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libssl3  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-88823](https://security-tracker.debian.org/tracker/CVE-2026-88823)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libssl3@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=openssl"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-88823-openssl",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-88823 low vulnerability for openssl package"
              },
              "fullDescription": {
                "text": "Issue summary: The AES-GCM-SIV implementation treats a zero-length Additional Authenticated Data (AAD) update as a reset of all the AAD supplied so far, instead of leaving the AAD unchanged. An application that supplies its AAD in several fragments, one of which is empty, therefore produces or verifies messages whose authentication tag does not cover the AAD supplied before the empty fragment.  Impact summary: Data an application intended to authenticate alongside a message is silently left unauthenticated. An attacker can forge the AAD of such a message.  CWE: CWE-325: Missing Cryptographic Step  Description: An application passing AAD in multiple chunks of which some have zero length will have the previous AAD chunks effectively unauthenticated. Also, on context re-initialisation, the AAD was not reset, which meant that any AAD accumulated from the previous context usage were also included in the AAD of the new message.  The fix makes a zero-length AAD update a no-op and clears any accumulated AAD whenever the context is re-initialised with a key or a nonce. A re-initialisation that only changes parameters keeps the AAD.  FIPS impact: no The FIPS modules are not affected, as AES-GCM-SIV is not a FIPS approved algorithm and is implemented only in the default provider, outside the OpenSSL FIPS module boundary."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-88823\nSeverity: low\nPackage: openssl\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-88823](https://security-tracker.debian.org/tracker/CVE-2026-88823)",
                "markdown": "**Vulnerability CVE-2026-88823**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | openssl  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-88823](https://security-tracker.debian.org/tracker/CVE-2026-88823)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/openssl@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-18508-tar",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-18508 medium vulnerability for tar package"
              },
              "fullDescription": {
                "text": "A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-18508\nSeverity: medium\nPackage: tar\nVersion: 1.34+dfsg-1.2+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-18508](https://security-tracker.debian.org/tracker/CVE-2026-18508)",
                "markdown": "**Vulnerability CVE-2026-18508**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | tar  | 1.34+dfsg-1.2+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-18508](https://security-tracker.debian.org/tracker/CVE-2026-18508)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "4.4"
              }
            },
            {
              "id": "CVE-2026-54370-libacl1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-54370 high vulnerability for libacl1 package"
              },
              "fullDescription": {
                "text": "acl before version 2.4.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link between an lstat() check and subsequent symlink-following operations such as stat(), chown(), chmod(), acl_get_file(), and acl_set_file(). Attackers who control a pathname component can redirect file access control list operations to arbitrary files when getfacl, setfacl, or chacl is invoked by a privileged process over an attacker-controlled path, resulting in local privilege escalation."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-54370\nSeverity: high\nPackage: libacl1\nVersion: 2.3.1-3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-54370](https://security-tracker.debian.org/tracker/CVE-2026-54370)",
                "markdown": "**Vulnerability CVE-2026-54370**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| high  | libacl1  | 2.3.1-3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-54370](https://security-tracker.debian.org/tracker/CVE-2026-54370)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libacl1@2.3.1-3?arch=amd64\u0026distro=debian-12\u0026upstream=acl"
                ],
                "security-severity": "7.2"
              }
            },
            {
              "id": "CVE-2026-107496-libssl3",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-107496 low vulnerability for libssl3 package"
              },
              "fullDescription": {
                "text": "Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.  Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service.  CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')  Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns.  The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop.  OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option.  The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected.  The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely.  FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-107496\nSeverity: low\nPackage: libssl3\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-107496](https://security-tracker.debian.org/tracker/CVE-2026-107496)",
                "markdown": "**Vulnerability CVE-2026-107496**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libssl3  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-107496](https://security-tracker.debian.org/tracker/CVE-2026-107496)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libssl3@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=openssl"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-107496-openssl",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-107496 low vulnerability for openssl package"
              },
              "fullDescription": {
                "text": "Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indefinitely.  Impact summary: An attacker able to supply the recipient certificate to an application performing CMS encryption can cause that application to loop indefinitely, consuming CPU and resulting in Denial of Service.  CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')  Description: CMS_encrypt() and CMS_encrypt_ex() encrypt a message to one or more recipient certificates and, for an EC recipient, generate an ephemeral key in the recipient's group. If the certificate declares a group order of 1, random scalar generation can only produce zero. The key generation routine then retries without limit while waiting for a nonzero private scalar, so the call never returns.  The OpenSSL TLS and QUIC implementations do not use this path. An application is exposed only if it calls CMS_encrypt() or CMS_encrypt_ex() with a recipient certificate whose EC parameters are attacker-controlled. Certificates with normal EC group orders do not trigger the loop.  OpenSSL 4.0 and later reject unknown explicit EC groups in default builds. These versions are affected only when configured with the enable-ec_explicit_curves option.  The result is a hang that consumes a CPU core until the process is interrupted, a Denial of Service. The severity is Low because the attacker must supply the recipient certificate and the application must choose to encrypt to it; ordinary CMS encryption to trusted recipients is unaffected.  The fix makes EC key generation fail when the group has no valid nonzero private scalar, instead of retrying indefinitely.  FIPS impact: no The FIPS modules in 4.1, 4.0, 3.5 and 3.0 are not affected. The FIPS provider does not support arbitrary explicit EC domain parameters, so an order-1 group is rejected during key import before the vulnerable key generation path is reached."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-107496\nSeverity: low\nPackage: openssl\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-107496](https://security-tracker.debian.org/tracker/CVE-2026-107496)",
                "markdown": "**Vulnerability CVE-2026-107496**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | openssl  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-107496](https://security-tracker.debian.org/tracker/CVE-2026-107496)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/openssl@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "0.0"
              }
            },
            {
              "id": "CVE-2026-42250-libbz2-1.0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-42250 medium vulnerability for libbz2-1.0 package"
              },
              "fullDescription": {
                "text": "bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).  This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-42250\nSeverity: medium\nPackage: libbz2-1.0\nVersion: 1.0.8-5+b1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-42250](https://security-tracker.debian.org/tracker/CVE-2026-42250)",
                "markdown": "**Vulnerability CVE-2026-42250**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libbz2-1.0  | 1.0.8-5+b1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-42250](https://security-tracker.debian.org/tracker/CVE-2026-42250)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libbz2-1.0@1.0.8-5%2Bb1?arch=amd64\u0026distro=debian-12\u0026upstream=bzip2%401.0.8-5"
                ],
                "security-severity": "4.8"
              }
            },
            {
              "id": "CVE-2026-18938-libp11-kit0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-18938 medium vulnerability for libp11-kit0 package"
              },
              "fullDescription": {
                "text": "A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 bit systems."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-18938\nSeverity: medium\nPackage: libp11-kit0\nVersion: 0.24.1-2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-18938](https://security-tracker.debian.org/tracker/CVE-2026-18938)",
                "markdown": "**Vulnerability CVE-2026-18938**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libp11-kit0  | 0.24.1-2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-18938](https://security-tracker.debian.org/tracker/CVE-2026-18938)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libp11-kit0@0.24.1-2?arch=amd64\u0026distro=debian-12\u0026upstream=p11-kit"
                ],
                "security-severity": "6.2"
              }
            },
            {
              "id": "CVE-2011-3374-apt",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2011-3374 low vulnerability for apt package"
              },
              "fullDescription": {
                "text": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2011-3374\nSeverity: low\nPackage: apt\nVersion: 2.6.2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2011-3374](https://security-tracker.debian.org/tracker/CVE-2011-3374)",
                "markdown": "**Vulnerability CVE-2011-3374**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | apt  | 2.6.2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2011-3374](https://security-tracker.debian.org/tracker/CVE-2011-3374)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/apt@2.6.2?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "4.3"
              }
            },
            {
              "id": "CVE-2011-3374-libapt-pkg6.0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2011-3374 low vulnerability for libapt-pkg6.0 package"
              },
              "fullDescription": {
                "text": "It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2011-3374\nSeverity: low\nPackage: libapt-pkg6.0\nVersion: 2.6.2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2011-3374](https://security-tracker.debian.org/tracker/CVE-2011-3374)",
                "markdown": "**Vulnerability CVE-2011-3374**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libapt-pkg6.0  | 2.6.2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2011-3374](https://security-tracker.debian.org/tracker/CVE-2011-3374)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libapt-pkg6.0@2.6.2?arch=amd64\u0026distro=debian-12\u0026upstream=apt"
                ],
                "security-severity": "4.3"
              }
            },
            {
              "id": "CVE-2024-2236-libgcrypt20",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2024-2236 low vulnerability for libgcrypt20 package"
              },
              "fullDescription": {
                "text": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2024-2236\nSeverity: low\nPackage: libgcrypt20\nVersion: 1.10.1-3+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2024-2236](https://security-tracker.debian.org/tracker/CVE-2024-2236)",
                "markdown": "**Vulnerability CVE-2024-2236**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgcrypt20  | 1.10.1-3+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2024-2236](https://security-tracker.debian.org/tracker/CVE-2024-2236)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgcrypt20@1.10.1-3%2Bdeb12u1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "5.9"
              }
            },
            {
              "id": "CVE-2026-41991-gzip",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-41991 medium vulnerability for gzip package"
              },
              "fullDescription": {
                "text": "GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID (PID). This predictable filename is created without exclusive access or existence checks. A local attacker can pre‑create the predicted temporary file path as a symbolic link pointing to an arbitrary file writable by the victim. When gzexe runs, it follows the symlink and overwrites the target file, resulting in a time‑of‑check to time‑of‑use (TOCTOU) condition that allows arbitrary file overwrite.  This issue has been fixed in the commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-41991\nSeverity: medium\nPackage: gzip\nVersion: 1.12-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-41991](https://security-tracker.debian.org/tracker/CVE-2026-41991)",
                "markdown": "**Vulnerability CVE-2026-41991**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | gzip  | 1.12-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-41991](https://security-tracker.debian.org/tracker/CVE-2026-41991)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gzip@1.12-1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-40228-libsystemd0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-40228 low vulnerability for libsystemd0 package"
              },
              "fullDescription": {
                "text": "In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-40228\nSeverity: low\nPackage: libsystemd0\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-40228](https://security-tracker.debian.org/tracker/CVE-2026-40228)",
                "markdown": "**Vulnerability CVE-2026-40228**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libsystemd0  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-40228](https://security-tracker.debian.org/tracker/CVE-2026-40228)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "3.3"
              }
            },
            {
              "id": "CVE-2026-40228-libudev1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-40228 low vulnerability for libudev1 package"
              },
              "fullDescription": {
                "text": "In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a \"logger -p emerg\" command is executed, if ForwardToWall=yes is set."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-40228\nSeverity: low\nPackage: libudev1\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-40228](https://security-tracker.debian.org/tracker/CVE-2026-40228)",
                "markdown": "**Vulnerability CVE-2026-40228**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libudev1  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-40228](https://security-tracker.debian.org/tracker/CVE-2026-40228)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "3.3"
              }
            },
            {
              "id": "CVE-2026-86805-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-86805 medium vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.  Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-86805\nSeverity: medium\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-86805](https://security-tracker.debian.org/tracker/CVE-2026-86805)",
                "markdown": "**Vulnerability CVE-2026-86805**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-86805](https://security-tracker.debian.org/tracker/CVE-2026-86805)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "6.3"
              }
            },
            {
              "id": "CVE-2026-86805-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-86805 medium vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.  Exploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-86805\nSeverity: medium\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-86805](https://security-tracker.debian.org/tracker/CVE-2026-86805)",
                "markdown": "**Vulnerability CVE-2026-86805**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-86805](https://security-tracker.debian.org/tracker/CVE-2026-86805)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "6.3"
              }
            },
            {
              "id": "CVE-2025-68972-gpgv",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-68972 medium vulnerability for gpgv package"
              },
              "fullDescription": {
                "text": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-68972\nSeverity: medium\nPackage: gpgv\nVersion: 2.2.40-1.1+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-68972](https://security-tracker.debian.org/tracker/CVE-2025-68972)",
                "markdown": "**Vulnerability CVE-2025-68972**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | gpgv  | 2.2.40-1.1+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-68972](https://security-tracker.debian.org/tracker/CVE-2025-68972)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=gnupg2"
                ],
                "security-severity": "4.7"
              }
            },
            {
              "id": "CVE-2026-18477-tar",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-18477 medium vulnerability for tar package"
              },
              "fullDescription": {
                "text": "A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-18477\nSeverity: medium\nPackage: tar\nVersion: 1.34+dfsg-1.2+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-18477](https://security-tracker.debian.org/tracker/CVE-2026-18477)",
                "markdown": "**Vulnerability CVE-2026-18477**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | tar  | 1.34+dfsg-1.2+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-18477](https://security-tracker.debian.org/tracker/CVE-2026-18477)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "4.4"
              }
            },
            {
              "id": "CVE-2022-27943-gcc-12-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-27943 low vulnerability for gcc-12-base package"
              },
              "fullDescription": {
                "text": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-27943\nSeverity: low\nPackage: gcc-12-base\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-27943](https://security-tracker.debian.org/tracker/CVE-2022-27943)",
                "markdown": "**Vulnerability CVE-2022-27943**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | gcc-12-base  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-27943](https://security-tracker.debian.org/tracker/CVE-2022-27943)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2022-27943-libgcc-s1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-27943 low vulnerability for libgcc-s1 package"
              },
              "fullDescription": {
                "text": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-27943\nSeverity: low\nPackage: libgcc-s1\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-27943](https://security-tracker.debian.org/tracker/CVE-2022-27943)",
                "markdown": "**Vulnerability CVE-2022-27943**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgcc-s1  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-27943](https://security-tracker.debian.org/tracker/CVE-2022-27943)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2022-27943-libstdc++6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-27943 low vulnerability for libstdc++6 package"
              },
              "fullDescription": {
                "text": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-27943\nSeverity: low\nPackage: libstdc++6\nVersion: 12.2.0-14+deb12u1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-27943](https://security-tracker.debian.org/tracker/CVE-2022-27943)",
                "markdown": "**Vulnerability CVE-2022-27943**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libstdc++6  | 12.2.0-14+deb12u1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-27943](https://security-tracker.debian.org/tracker/CVE-2022-27943)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64\u0026distro=debian-12\u0026upstream=gcc-12"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2007-5686-login",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2007-5686 low vulnerability for login package"
              },
              "fullDescription": {
                "text": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2007-5686\nSeverity: low\nPackage: login\nVersion: 1:4.13+dfsg1-1+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2007-5686](https://security-tracker.debian.org/tracker/CVE-2007-5686)",
                "markdown": "**Vulnerability CVE-2007-5686**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | login  | 1:4.13+dfsg1-1+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2007-5686](https://security-tracker.debian.org/tracker/CVE-2007-5686)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/login@1%3A4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=shadow"
                ],
                "security-severity": "4.9"
              }
            },
            {
              "id": "CVE-2007-5686-passwd",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2007-5686 low vulnerability for passwd package"
              },
              "fullDescription": {
                "text": "initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2007-5686\nSeverity: low\nPackage: passwd\nVersion: 1:4.13+dfsg1-1+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2007-5686](https://security-tracker.debian.org/tracker/CVE-2007-5686)",
                "markdown": "**Vulnerability CVE-2007-5686**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | passwd  | 1:4.13+dfsg1-1+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2007-5686](https://security-tracker.debian.org/tracker/CVE-2007-5686)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/passwd@1%3A4.13%2Bdfsg1-1%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=shadow"
                ],
                "security-severity": "4.9"
              }
            },
            {
              "id": "CVE-2026-105712-gpgv",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-105712 low vulnerability for gpgv package"
              },
              "fullDescription": {
                "text": "gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-105712\nSeverity: low\nPackage: gpgv\nVersion: 2.2.40-1.1+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-105712](https://security-tracker.debian.org/tracker/CVE-2026-105712)",
                "markdown": "**Vulnerability CVE-2026-105712**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | gpgv  | 2.2.40-1.1+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-105712](https://security-tracker.debian.org/tracker/CVE-2026-105712)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=gnupg2"
                ],
                "security-severity": "3.6"
              }
            },
            {
              "id": "CVE-2026-57062-gpgv",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-57062 low vulnerability for gpgv package"
              },
              "fullDescription": {
                "text": "CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-57062\nSeverity: low\nPackage: gpgv\nVersion: 2.2.40-1.1+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-57062](https://security-tracker.debian.org/tracker/CVE-2026-57062)",
                "markdown": "**Vulnerability CVE-2026-57062**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | gpgv  | 2.2.40-1.1+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-57062](https://security-tracker.debian.org/tracker/CVE-2026-57062)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=gnupg2"
                ],
                "security-severity": "2.9"
              }
            },
            {
              "id": "CVE-2026-95818-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95818 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.  When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95818\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95818](https://security-tracker.debian.org/tracker/CVE-2026-95818)",
                "markdown": "**Vulnerability CVE-2026-95818**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95818](https://security-tracker.debian.org/tracker/CVE-2026-95818)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "3.6"
              }
            },
            {
              "id": "CVE-2026-95818-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95818 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.  When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95818\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95818](https://security-tracker.debian.org/tracker/CVE-2026-95818)",
                "markdown": "**Vulnerability CVE-2026-95818**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95818](https://security-tracker.debian.org/tracker/CVE-2026-95818)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "3.6"
              }
            },
            {
              "id": "CVE-2026-16742-libsystemd0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-16742 medium vulnerability for libsystemd0 package"
              },
              "fullDescription": {
                "text": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-16742\nSeverity: medium\nPackage: libsystemd0\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-16742](https://security-tracker.debian.org/tracker/CVE-2026-16742)",
                "markdown": "**Vulnerability CVE-2026-16742**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libsystemd0  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-16742](https://security-tracker.debian.org/tracker/CVE-2026-16742)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "6.7"
              }
            },
            {
              "id": "CVE-2026-16742-libudev1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-16742 medium vulnerability for libudev1 package"
              },
              "fullDescription": {
                "text": "systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-16742\nSeverity: medium\nPackage: libudev1\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-16742](https://security-tracker.debian.org/tracker/CVE-2026-16742)",
                "markdown": "**Vulnerability CVE-2026-16742**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| medium  | libudev1  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-16742](https://security-tracker.debian.org/tracker/CVE-2026-16742)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "6.7"
              }
            },
            {
              "id": "CVE-2026-6368-libc-bin",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-6368 low vulnerability for libc-bin package"
              },
              "fullDescription": {
                "text": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-6368\nSeverity: low\nPackage: libc-bin\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-6368](https://security-tracker.debian.org/tracker/CVE-2026-6368)",
                "markdown": "**Vulnerability CVE-2026-6368**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc-bin  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-6368](https://security-tracker.debian.org/tracker/CVE-2026-6368)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc-bin@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "2.1"
              }
            },
            {
              "id": "CVE-2026-6368-libc6",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-6368 low vulnerability for libc6 package"
              },
              "fullDescription": {
                "text": "Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-6368\nSeverity: low\nPackage: libc6\nVersion: 2.36-9+deb12u14\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-6368](https://security-tracker.debian.org/tracker/CVE-2026-6368)",
                "markdown": "**Vulnerability CVE-2026-6368**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libc6  | 2.36-9+deb12u14  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-6368](https://security-tracker.debian.org/tracker/CVE-2026-6368)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libc6@2.36-9%2Bdeb12u14?arch=amd64\u0026distro=debian-12\u0026upstream=glibc"
                ],
                "security-severity": "2.1"
              }
            },
            {
              "id": "CVE-2011-4116-perl-base",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2011-4116 low vulnerability for perl-base package"
              },
              "fullDescription": {
                "text": "_is_safe in the File::Temp module for Perl does not properly handle symlinks."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2011-4116\nSeverity: low\nPackage: perl-base\nVersion: 5.36.0-7+deb12u4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2011-4116](https://security-tracker.debian.org/tracker/CVE-2011-4116)",
                "markdown": "**Vulnerability CVE-2011-4116**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | perl-base  | 5.36.0-7+deb12u4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2011-4116](https://security-tracker.debian.org/tracker/CVE-2011-4116)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/perl-base@5.36.0-7%2Bdeb12u4?arch=amd64\u0026distro=debian-12\u0026upstream=perl"
                ],
                "security-severity": "3.3"
              }
            },
            {
              "id": "CVE-2013-4392-libsystemd0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2013-4392 low vulnerability for libsystemd0 package"
              },
              "fullDescription": {
                "text": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2013-4392\nSeverity: low\nPackage: libsystemd0\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2013-4392](https://security-tracker.debian.org/tracker/CVE-2013-4392)",
                "markdown": "**Vulnerability CVE-2013-4392**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libsystemd0  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2013-4392](https://security-tracker.debian.org/tracker/CVE-2013-4392)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.0"
              }
            },
            {
              "id": "CVE-2013-4392-libudev1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2013-4392 low vulnerability for libudev1 package"
              },
              "fullDescription": {
                "text": "systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2013-4392\nSeverity: low\nPackage: libudev1\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2013-4392](https://security-tracker.debian.org/tracker/CVE-2013-4392)",
                "markdown": "**Vulnerability CVE-2013-4392**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libudev1  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2013-4392](https://security-tracker.debian.org/tracker/CVE-2013-4392)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.0"
              }
            },
            {
              "id": "CVE-2025-27587-libssl3",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-27587 low vulnerability for libssl3 package"
              },
              "fullDescription": {
                "text": "OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-27587\nSeverity: low\nPackage: libssl3\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-27587](https://security-tracker.debian.org/tracker/CVE-2025-27587)",
                "markdown": "**Vulnerability CVE-2025-27587**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libssl3  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-27587](https://security-tracker.debian.org/tracker/CVE-2025-27587)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libssl3@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=openssl"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2025-27587-openssl",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2025-27587 low vulnerability for openssl package"
              },
              "fullDescription": {
                "text": "OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-27587\nSeverity: low\nPackage: openssl\nVersion: 3.0.22-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-27587](https://security-tracker.debian.org/tracker/CVE-2025-27587)",
                "markdown": "**Vulnerability CVE-2025-27587**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | openssl  | 3.0.22-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-27587](https://security-tracker.debian.org/tracker/CVE-2025-27587)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/openssl@3.0.22-1~deb12u2?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2022-0563-bsdutils",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-0563 low vulnerability for bsdutils package"
              },
              "fullDescription": {
                "text": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-0563\nSeverity: low\nPackage: bsdutils\nVersion: 1:2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)",
                "markdown": "**Vulnerability CVE-2022-0563**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | bsdutils  | 1:2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/bsdutils@1%3A2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux%402.38.1-5%2Bdeb12u3"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2022-0563-libblkid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-0563 low vulnerability for libblkid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-0563\nSeverity: low\nPackage: libblkid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)",
                "markdown": "**Vulnerability CVE-2022-0563**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libblkid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2022-0563-libmount1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-0563 low vulnerability for libmount1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-0563\nSeverity: low\nPackage: libmount1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)",
                "markdown": "**Vulnerability CVE-2022-0563**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libmount1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2022-0563-libsmartcols1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-0563 low vulnerability for libsmartcols1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-0563\nSeverity: low\nPackage: libsmartcols1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)",
                "markdown": "**Vulnerability CVE-2022-0563**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libsmartcols1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2022-0563-libuuid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-0563 low vulnerability for libuuid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-0563\nSeverity: low\nPackage: libuuid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)",
                "markdown": "**Vulnerability CVE-2022-0563**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libuuid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2022-0563-mount",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-0563 low vulnerability for mount package"
              },
              "fullDescription": {
                "text": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-0563\nSeverity: low\nPackage: mount\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)",
                "markdown": "**Vulnerability CVE-2022-0563**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | mount  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2022-0563-util-linux",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2022-0563 low vulnerability for util-linux package"
              },
              "fullDescription": {
                "text": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-0563\nSeverity: low\nPackage: util-linux\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)",
                "markdown": "**Vulnerability CVE-2022-0563**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | util-linux  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2022-0563-util-linux-extra",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-0563 low vulnerability for util-linux-extra package"
              },
              "fullDescription": {
                "text": "A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an \"INPUTRC\" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-0563\nSeverity: low\nPackage: util-linux-extra\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)",
                "markdown": "**Vulnerability CVE-2022-0563**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | util-linux-extra  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-0563](https://security-tracker.debian.org/tracker/CVE-2022-0563)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "5.5"
              }
            },
            {
              "id": "CVE-2023-31439-libsystemd0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-31439 low vulnerability for libsystemd0 package"
              },
              "fullDescription": {
                "text": "An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-31439\nSeverity: low\nPackage: libsystemd0\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-31439](https://security-tracker.debian.org/tracker/CVE-2023-31439)",
                "markdown": "**Vulnerability CVE-2023-31439**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libsystemd0  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-31439](https://security-tracker.debian.org/tracker/CVE-2023-31439)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2023-31439-libudev1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-31439 low vulnerability for libudev1 package"
              },
              "fullDescription": {
                "text": "An issue was discovered in systemd 253. An attacker can modify the contents of past events in a sealed log file and then adjust the file such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-31439\nSeverity: low\nPackage: libudev1\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-31439](https://security-tracker.debian.org/tracker/CVE-2023-31439)",
                "markdown": "**Vulnerability CVE-2023-31439**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libudev1  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-31439](https://security-tracker.debian.org/tracker/CVE-2023-31439)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2017-18018-coreutils",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2017-18018 low vulnerability for coreutils package"
              },
              "fullDescription": {
                "text": "In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2017-18018\nSeverity: low\nPackage: coreutils\nVersion: 9.1-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2017-18018](https://security-tracker.debian.org/tracker/CVE-2017-18018)",
                "markdown": "**Vulnerability CVE-2017-18018**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | coreutils  | 9.1-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2017-18018](https://security-tracker.debian.org/tracker/CVE-2017-18018)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "7.1"
              }
            },
            {
              "id": "CVE-2023-31437-libsystemd0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-31437 low vulnerability for libsystemd0 package"
              },
              "fullDescription": {
                "text": "An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-31437\nSeverity: low\nPackage: libsystemd0\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-31437](https://security-tracker.debian.org/tracker/CVE-2023-31437)",
                "markdown": "**Vulnerability CVE-2023-31437**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libsystemd0  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-31437](https://security-tracker.debian.org/tracker/CVE-2023-31437)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2023-31437-libudev1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-31437 low vulnerability for libudev1 package"
              },
              "fullDescription": {
                "text": "An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-31437\nSeverity: low\nPackage: libudev1\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-31437](https://security-tracker.debian.org/tracker/CVE-2023-31437)",
                "markdown": "**Vulnerability CVE-2023-31437**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libudev1  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-31437](https://security-tracker.debian.org/tracker/CVE-2023-31437)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2023-31438-libsystemd0",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-31438 low vulnerability for libsystemd0 package"
              },
              "fullDescription": {
                "text": "An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-31438\nSeverity: low\nPackage: libsystemd0\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-31438](https://security-tracker.debian.org/tracker/CVE-2023-31438)",
                "markdown": "**Vulnerability CVE-2023-31438**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libsystemd0  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-31438](https://security-tracker.debian.org/tracker/CVE-2023-31438)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsystemd0@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2023-31438-libudev1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2023-31438 low vulnerability for libudev1 package"
              },
              "fullDescription": {
                "text": "An issue was discovered in systemd 253. An attacker can truncate a sealed log file and then resume log sealing such that checking the integrity shows no error, despite modifications. NOTE: the vendor reportedly sent \"a reply denying that any of the finding was a security vulnerability.\""
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2023-31438\nSeverity: low\nPackage: libudev1\nVersion: 252.39-1~deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2023-31438](https://security-tracker.debian.org/tracker/CVE-2023-31438)",
                "markdown": "**Vulnerability CVE-2023-31438**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libudev1  | 252.39-1~deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2023-31438](https://security-tracker.debian.org/tracker/CVE-2023-31438)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libudev1@252.39-1~deb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=systemd"
                ],
                "security-severity": "5.3"
              }
            },
            {
              "id": "CVE-2025-5278-coreutils",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2025-5278 low vulnerability for coreutils package"
              },
              "fullDescription": {
                "text": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-5278\nSeverity: low\nPackage: coreutils\nVersion: 9.1-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-5278](https://security-tracker.debian.org/tracker/CVE-2025-5278)",
                "markdown": "**Vulnerability CVE-2025-5278**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | coreutils  | 9.1-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-5278](https://security-tracker.debian.org/tracker/CVE-2025-5278)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "4.4"
              }
            },
            {
              "id": "CVE-2022-3219-gpgv",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2022-3219 low vulnerability for gpgv package"
              },
              "fullDescription": {
                "text": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2022-3219\nSeverity: low\nPackage: gpgv\nVersion: 2.2.40-1.1+deb12u2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2022-3219](https://security-tracker.debian.org/tracker/CVE-2022-3219)",
                "markdown": "**Vulnerability CVE-2022-3219**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | gpgv  | 2.2.40-1.1+deb12u2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2022-3219](https://security-tracker.debian.org/tracker/CVE-2022-3219)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/gpgv@2.2.40-1.1%2Bdeb12u2?arch=amd64\u0026distro=debian-12\u0026upstream=gnupg2"
                ],
                "security-severity": "3.3"
              }
            },
            {
              "id": "CVE-2026-53910-diffutils",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-53910 low vulnerability for diffutils package"
              },
              "fullDescription": {
                "text": "diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds. When processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing.  An attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.   This issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815   NOTE: The project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-53910\nSeverity: low\nPackage: diffutils\nVersion: 1:3.8-4\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-53910](https://security-tracker.debian.org/tracker/CVE-2026-53910)",
                "markdown": "**Vulnerability CVE-2026-53910**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | diffutils  | 1:3.8-4  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-53910](https://security-tracker.debian.org/tracker/CVE-2026-53910)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/diffutils@1%3A3.8-4?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "2.1"
              }
            },
            {
              "id": "CVE-2026-88647-libgnutls30",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-88647 low vulnerability for libgnutls30 package"
              },
              "fullDescription": {
                "text": "GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (1.3.6.1.5.5.7.8.7) whose value is an OCTET STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-88647\nSeverity: low\nPackage: libgnutls30\nVersion: 3.7.9-2+deb12u7\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-88647](https://security-tracker.debian.org/tracker/CVE-2026-88647)",
                "markdown": "**Vulnerability CVE-2026-88647**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgnutls30  | 3.7.9-2+deb12u7  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-88647](https://security-tracker.debian.org/tracker/CVE-2026-88647)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u7?arch=amd64\u0026distro=debian-12\u0026upstream=gnutls28"
                ],
                "security-severity": "6.5"
              }
            },
            {
              "id": "CVE-2025-14104-bsdutils",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-14104 low vulnerability for bsdutils package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-14104\nSeverity: low\nPackage: bsdutils\nVersion: 1:2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)",
                "markdown": "**Vulnerability CVE-2025-14104**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | bsdutils  | 1:2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/bsdutils@1%3A2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux%402.38.1-5%2Bdeb12u3"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2025-14104-libblkid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-14104 low vulnerability for libblkid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-14104\nSeverity: low\nPackage: libblkid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)",
                "markdown": "**Vulnerability CVE-2025-14104**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libblkid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libblkid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2025-14104-libmount1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-14104 low vulnerability for libmount1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-14104\nSeverity: low\nPackage: libmount1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)",
                "markdown": "**Vulnerability CVE-2025-14104**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libmount1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libmount1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2025-14104-libsmartcols1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-14104 low vulnerability for libsmartcols1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-14104\nSeverity: low\nPackage: libsmartcols1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)",
                "markdown": "**Vulnerability CVE-2025-14104**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libsmartcols1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libsmartcols1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2025-14104-libuuid1",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-14104 low vulnerability for libuuid1 package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-14104\nSeverity: low\nPackage: libuuid1\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)",
                "markdown": "**Vulnerability CVE-2025-14104**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libuuid1  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libuuid1@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2025-14104-mount",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-14104 low vulnerability for mount package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-14104\nSeverity: low\nPackage: mount\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)",
                "markdown": "**Vulnerability CVE-2025-14104**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | mount  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/mount@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2025-14104-util-linux",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2025-14104 low vulnerability for util-linux package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-14104\nSeverity: low\nPackage: util-linux\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)",
                "markdown": "**Vulnerability CVE-2025-14104**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | util-linux  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2025-14104-util-linux-extra",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2025-14104 low vulnerability for util-linux-extra package"
              },
              "fullDescription": {
                "text": "A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2025-14104\nSeverity: low\nPackage: util-linux-extra\nVersion: 2.38.1-5+deb12u3\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)",
                "markdown": "**Vulnerability CVE-2025-14104**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | util-linux-extra  | 2.38.1-5+deb12u3  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2025-14104](https://security-tracker.debian.org/tracker/CVE-2025-14104)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/util-linux-extra@2.38.1-5%2Bdeb12u3?arch=amd64\u0026distro=debian-12\u0026upstream=util-linux"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2026-95184-libgnutls30",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95184 low vulnerability for libgnutls30 package"
              },
              "fullDescription": {
                "text": "GnuTLS v3.8.13 does not properly enforce name constraints, as demonstrated by a permitted subtree violation for \"EE O=Evil accepted although outside permitted O=Good.\" NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95184\nSeverity: low\nPackage: libgnutls30\nVersion: 3.7.9-2+deb12u7\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95184](https://security-tracker.debian.org/tracker/CVE-2026-95184)",
                "markdown": "**Vulnerability CVE-2026-95184**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgnutls30  | 3.7.9-2+deb12u7  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95184](https://security-tracker.debian.org/tracker/CVE-2026-95184)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u7?arch=amd64\u0026distro=debian-12\u0026upstream=gnutls28"
                ],
                "security-severity": "5.9"
              }
            },
            {
              "id": "CVE-2026-88648-libgnutls30",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-88648 low vulnerability for libgnutls30 package"
              },
              "fullDescription": {
                "text": "In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-88648\nSeverity: low\nPackage: libgnutls30\nVersion: 3.7.9-2+deb12u7\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-88648](https://security-tracker.debian.org/tracker/CVE-2026-88648)",
                "markdown": "**Vulnerability CVE-2026-88648**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgnutls30  | 3.7.9-2+deb12u7  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-88648](https://security-tracker.debian.org/tracker/CVE-2026-88648)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u7?arch=amd64\u0026distro=debian-12\u0026upstream=gnutls28"
                ],
                "security-severity": "3.7"
              }
            },
            {
              "id": "CVE-2026-95210-libgnutls30",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-95210 low vulnerability for libgnutls30 package"
              },
              "fullDescription": {
                "text": "GnuTLS v3.8.13 does not reject a critical keyUsage extension when it cannot be processed, such as when extnValue is an ASN.1 NULL (05 00) instead of a BIT STRING. NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-95210\nSeverity: low\nPackage: libgnutls30\nVersion: 3.7.9-2+deb12u7\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-95210](https://security-tracker.debian.org/tracker/CVE-2026-95210)",
                "markdown": "**Vulnerability CVE-2026-95210**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgnutls30  | 3.7.9-2+deb12u7  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-95210](https://security-tracker.debian.org/tracker/CVE-2026-95210)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u7?arch=amd64\u0026distro=debian-12\u0026upstream=gnutls28"
                ],
                "security-severity": "4.8"
              }
            },
            {
              "id": "CVE-2026-56392-coreutils",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-56392 low vulnerability for coreutils package"
              },
              "fullDescription": {
                "text": "GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer. When processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.  When running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.           This issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-56392\nSeverity: low\nPackage: coreutils\nVersion: 9.1-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-56392](https://security-tracker.debian.org/tracker/CVE-2026-56392)",
                "markdown": "**Vulnerability CVE-2026-56392**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | coreutils  | 9.1-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-56392](https://security-tracker.debian.org/tracker/CVE-2026-56392)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2026-67693-libgnutls30",
              "name": "DpkgMatcherExactIndirectMatch",
              "shortDescription": {
                "text": "CVE-2026-67693 low vulnerability for libgnutls30 package"
              },
              "fullDescription": {
                "text": "GnuTLS v3.8.13 does not reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU). NOTE: the Supplier does not consider this an actionable security vulnerability because of its \"threat model doesn't consider attacks only possible by modifying anything within the trust boundary (private keys, trusted certificate authorities and their issued certificates including intermediate CAs, etc.)\" policy."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-67693\nSeverity: low\nPackage: libgnutls30\nVersion: 3.7.9-2+deb12u7\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-67693](https://security-tracker.debian.org/tracker/CVE-2026-67693)",
                "markdown": "**Vulnerability CVE-2026-67693**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | libgnutls30  | 3.7.9-2+deb12u7  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-67693](https://security-tracker.debian.org/tracker/CVE-2026-67693)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/libgnutls30@3.7.9-2%2Bdeb12u7?arch=amd64\u0026distro=debian-12\u0026upstream=gnutls28"
                ],
                "security-severity": "3.7"
              }
            },
            {
              "id": "CVE-2026-56391-coreutils",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-56391 low vulnerability for coreutils package"
              },
              "fullDescription": {
                "text": "GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value.  This incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.  When running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.   This issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-56391\nSeverity: low\nPackage: coreutils\nVersion: 9.1-1\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-56391](https://security-tracker.debian.org/tracker/CVE-2026-56391)",
                "markdown": "**Vulnerability CVE-2026-56391**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | coreutils  | 9.1-1  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-56391](https://security-tracker.debian.org/tracker/CVE-2026-56391)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/coreutils@9.1-1?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "6.1"
              }
            },
            {
              "id": "CVE-2026-102474-dash",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-102474 low vulnerability for dash package"
              },
              "fullDescription": {
                "text": "A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \\u or \\U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, including through dash -c and a positional argument, can write one or two bytes past that reservation."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-102474\nSeverity: low\nPackage: dash\nVersion: 0.5.12-2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-102474](https://security-tracker.debian.org/tracker/CVE-2026-102474)",
                "markdown": "**Vulnerability CVE-2026-102474**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | dash  | 0.5.12-2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-102474](https://security-tracker.debian.org/tracker/CVE-2026-102474)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/dash@0.5.12-2?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "4.0"
              }
            },
            {
              "id": "CVE-2026-102473-dash",
              "name": "DpkgMatcherExactDirectMatch",
              "shortDescription": {
                "text": "CVE-2026-102473 low vulnerability for dash package"
              },
              "fullDescription": {
                "text": "A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU."
              },
              "helpUri": "https://github.com/anchore/grype",
              "help": {
                "text": "Vulnerability CVE-2026-102473\nSeverity: low\nPackage: dash\nVersion: 0.5.12-2\nFix Version: \nType: deb\nLocation: /var/lib/dpkg/status\nData Namespace: debian:distro:debian:12\nLink: [CVE-2026-102473](https://security-tracker.debian.org/tracker/CVE-2026-102473)",
                "markdown": "**Vulnerability CVE-2026-102473**\n| Severity | Package | Version | Fix Version | Type | Location | Data Namespace | Link |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| low  | dash  | 0.5.12-2  |   | deb  | /var/lib/dpkg/status  | debian:distro:debian:12  | [CVE-2026-102473](https://security-tracker.debian.org/tracker/CVE-2026-102473)  |\n"
              },
              "properties": {
                "purls": [
                  "pkg:deb/debian/dash@0.5.12-2?arch=amd64\u0026distro=debian-12"
                ],
                "security-severity": "5.5"
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "GHSA-5crp-9r3c-p9vr-Newtonsoft.Json",
          "level": "error",
          "message": {
            "text": "A high vulnerability in dotnet package: Newtonsoft.Json, version 12.0.1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /app/BancoApi.deps.json"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//app/BancoApi.deps.json"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/app/BancoApi.deps.json",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:42d91f4f5408ecc350348466a0899dfd9cc8bb48a194a67b6ae1cfeadb9f74c2:/app/BancoApi.deps.json"
                },
                {
                  "name": "/app/Newtonsoft.Json.dll",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:42d91f4f5408ecc350348466a0899dfd9cc8bb48a194a67b6ae1cfeadb9f74c2:/app/Newtonsoft.Json.dll"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "82d450d80fc20d764de4abfbf9112759d75594aa27946b8dce0daa7e6f046679:1"
          }
        },
        {
          "ruleId": "CVE-2011-3389-libgnutls30",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgnutls30, version 3.7.9-2+deb12u7 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libgnutls30/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgnutls30/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgnutls30:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgnutls30:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "a765d4ad9e7eb7703af5a318fe9ecbf4848746f981eb0c1da3e29238b5ac5bd5:1"
          }
        },
        {
          "ruleId": "CVE-2025-13151-libtasn1-6",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libtasn1-6, version 4.19.0-2+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libtasn1-6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libtasn1-6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libtasn1-6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libtasn1-6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "7650d4334f25513e0eab05775f3839f68c9ff5199584115b601852f72c778f89:1"
          }
        },
        {
          "ruleId": "CVE-2023-50495-libtinfo6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libtinfo6, version 6.4-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libtinfo6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libtinfo6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libtinfo6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libtinfo6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "78b32bda088de644f4f1b58feb81283a86251bbb5036b71ddd8115ab129fa7a4:1"
          }
        },
        {
          "ruleId": "CVE-2023-50495-ncurses-base",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: ncurses-base, version 6.4-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/ncurses-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/ncurses-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-base.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-base.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-base.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-base.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-base.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-base.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "84efbc3133e553e7bf2ccbfbdb694f09bd4fece367db4521f19ca318251486fb:1"
          }
        },
        {
          "ruleId": "CVE-2023-50495-ncurses-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: ncurses-bin, version 6.4-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/ncurses-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/ncurses-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-bin.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "aa74d63bbc541f32ea937f40b78ce73e05cec28b352479d5d20c4a4dcd4783b1:1"
          }
        },
        {
          "ruleId": "CVE-2026-82560-perl-base",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: perl-base, version 5.36.0-7+deb12u4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/perl-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/perl-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.list"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "8ca9a169038c6959f92aec597f69ecea220d335109dea9da6fc6a4878ee9e8c5:1"
          }
        },
        {
          "ruleId": "CVE-2026-5450-libc-bin",
          "level": "error",
          "message": {
            "text": "A critical vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-5450-libc6",
          "level": "error",
          "message": {
            "text": "A critical vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-41992-gzip",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: gzip, version 1.12-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gzip/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gzip/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gzip.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gzip.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/gzip.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gzip.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "70eb1bfa602a04e05a48dc41c2ff7a97a0ef09d10226a64f00ca53bf1ee702dd:1"
          }
        },
        {
          "ruleId": "CVE-2026-76844-zlib1g",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: zlib1g, version 1:1.2.13.dfsg-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/zlib1g/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/zlib1g/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/zlib1g:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/zlib1g:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f8e351ed912a944098def4bde23e72742117a3b764e7970a3ff6f89ba0292864:1"
          }
        },
        {
          "ruleId": "CVE-2026-9538-perl-base",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: perl-base, version 5.36.0-7+deb12u4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/perl-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/perl-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.list"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "8ca9a169038c6959f92aec597f69ecea220d335109dea9da6fc6a4878ee9e8c5:1"
          }
        },
        {
          "ruleId": "CVE-2026-85091-zlib1g",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: zlib1g, version 1:1.2.13.dfsg-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/zlib1g/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/zlib1g/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/zlib1g:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/zlib1g:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f8e351ed912a944098def4bde23e72742117a3b764e7970a3ff6f89ba0292864:1"
          }
        },
        {
          "ruleId": "CVE-2026-95619-gcc-12-base",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: gcc-12-base, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gcc-12-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gcc-12-base:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gcc-12-base:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "29fd540536545577f5b63bd719de36dc38b793b477b2ef9c3e4253d04b2d2ea8:1"
          }
        },
        {
          "ruleId": "CVE-2026-95619-libgcc-s1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libgcc-s1, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgcc-s1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgcc-s1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgcc-s1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f1344a44c4beb6aebd0ed70e19f0e398101d438d59e15f714676c66e15d1377e:1"
          }
        },
        {
          "ruleId": "CVE-2026-95619-libstdc++6",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libstdc++6, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libstdc++6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libstdc++6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libstdc++6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b8eb81cb8a98ed7eacc05ec51b022a8f22d9cf8d62a0098d3e3bd28610954ff0:1"
          }
        },
        {
          "ruleId": "CVE-2026-114691-gcc-12-base",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: gcc-12-base, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gcc-12-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gcc-12-base:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gcc-12-base:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "29fd540536545577f5b63bd719de36dc38b793b477b2ef9c3e4253d04b2d2ea8:1"
          }
        },
        {
          "ruleId": "CVE-2026-114691-libgcc-s1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libgcc-s1, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgcc-s1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgcc-s1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgcc-s1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f1344a44c4beb6aebd0ed70e19f0e398101d438d59e15f714676c66e15d1377e:1"
          }
        },
        {
          "ruleId": "CVE-2026-114691-libstdc++6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libstdc++6, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libstdc++6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libstdc++6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libstdc++6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b8eb81cb8a98ed7eacc05ec51b022a8f22d9cf8d62a0098d3e3bd28610954ff0:1"
          }
        },
        {
          "ruleId": "CVE-2025-69720-libtinfo6",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libtinfo6, version 6.4-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libtinfo6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libtinfo6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libtinfo6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libtinfo6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "78b32bda088de644f4f1b58feb81283a86251bbb5036b71ddd8115ab129fa7a4:1"
          }
        },
        {
          "ruleId": "CVE-2025-69720-ncurses-base",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: ncurses-base, version 6.4-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/ncurses-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/ncurses-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-base.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-base.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-base.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-base.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-base.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-base.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "84efbc3133e553e7bf2ccbfbdb694f09bd4fece367db4521f19ca318251486fb:1"
          }
        },
        {
          "ruleId": "CVE-2025-69720-ncurses-bin",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: ncurses-bin, version 6.4-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/ncurses-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/ncurses-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-bin.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "aa74d63bbc541f32ea937f40b78ce73e05cec28b352479d5d20c4a4dcd4783b1:1"
          }
        },
        {
          "ruleId": "CVE-2026-102010-gcc-12-base",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: gcc-12-base, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gcc-12-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gcc-12-base:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gcc-12-base:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "29fd540536545577f5b63bd719de36dc38b793b477b2ef9c3e4253d04b2d2ea8:1"
          }
        },
        {
          "ruleId": "CVE-2026-102010-libgcc-s1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libgcc-s1, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgcc-s1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgcc-s1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgcc-s1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f1344a44c4beb6aebd0ed70e19f0e398101d438d59e15f714676c66e15d1377e:1"
          }
        },
        {
          "ruleId": "CVE-2026-102010-libstdc++6",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libstdc++6, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libstdc++6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libstdc++6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libstdc++6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b8eb81cb8a98ed7eacc05ec51b022a8f22d9cf8d62a0098d3e3bd28610954ff0:1"
          }
        },
        {
          "ruleId": "CVE-2018-20796-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2018-20796-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-5928-libc-bin",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-5928-libc6",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-5704-tar",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: tar, version 1.34+dfsg-1.2+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/tar/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/tar/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.list"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "c6ef66502513a49456229d7f627a79317de0b01b06a7b9260654c3d557fdde01:1"
          }
        },
        {
          "ruleId": "CVE-2026-3184-bsdutils",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: bsdutils, version 1:2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/bsdutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/bsdutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "51a2b3eb98cd1c97e76bc6bb58db803a82e978d6de088edc3332471c9db2becf:1"
          }
        },
        {
          "ruleId": "CVE-2026-3184-libblkid1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libblkid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libblkid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libblkid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libblkid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libblkid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "534a8e87480f3963eec561ccedd5a2c057b16f323c23bf7446cc387dc8736bc3:1"
          }
        },
        {
          "ruleId": "CVE-2026-3184-libmount1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libmount1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libmount1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libmount1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libmount1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libmount1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "fa217c11b0cc619816dd4be890cb20129cbcbfb114b768ca24b13e6baa3e6004:1"
          }
        },
        {
          "ruleId": "CVE-2026-3184-libsmartcols1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libsmartcols1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsmartcols1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsmartcols1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsmartcols1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsmartcols1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "69b210f67380054c97498fcf5715176fbd274047c3bd42c58343e2e9718a7086:1"
          }
        },
        {
          "ruleId": "CVE-2026-3184-libuuid1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libuuid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libuuid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libuuid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libuuid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libuuid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "33eb426befb943351f34d4cd44551778161b3810b05399d358e10c6182eb2629:1"
          }
        },
        {
          "ruleId": "CVE-2026-3184-mount",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: mount, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/mount/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/mount/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2b23a096f0dfd926935be7cc47d1f2d08ab59b4caeb2f1eb9d01c4fc15d4d900:1"
          }
        },
        {
          "ruleId": "CVE-2026-3184-util-linux",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: util-linux, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6e6fa287bae9b3826f47633badba6b5c6e5a7964d2d7b01462ed0c37e95ad4d5:1"
          }
        },
        {
          "ruleId": "CVE-2026-3184-util-linux-extra",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: util-linux-extra, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux-extra/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux-extra/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.preinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4a4f2e8358ffe479825ba4fc1a0226e70955b8803ad09494e61e86cc1f61d784:1"
          }
        },
        {
          "ruleId": "CVE-2026-19499-libc-bin",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-19499-libc6",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-84243-libc-bin",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-84243-libc6",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-6238-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-6238-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2005-2541-tar",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: tar, version 1.34+dfsg-1.2+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/tar/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/tar/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.list"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "c6ef66502513a49456229d7f627a79317de0b01b06a7b9260654c3d557fdde01:1"
          }
        },
        {
          "ruleId": "CVE-2026-77117-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-80489-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-77117-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-80489-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-54411-libpam-modules",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libpam-modules, version 1.5.2-6+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libpam-modules/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libpam-modules/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-modules:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-modules:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-modules:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-modules:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "02cff43398ea18cf80d671ff206a8f12b85576b37d07bf74ac11a5ae935ed291:1"
          }
        },
        {
          "ruleId": "CVE-2026-54411-libpam-modules-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libpam-modules-bin, version 1.5.2-6+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libpam-modules-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libpam-modules-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-modules-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-modules-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-modules-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-modules-bin.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "87ef29c52f7720c2457fdff05c52a957b4c7ff8af0e0221455184ba1993c3db9:1"
          }
        },
        {
          "ruleId": "CVE-2026-54411-libpam-runtime",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libpam-runtime, version 1.5.2-6+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libpam-runtime/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libpam-runtime/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.prerm"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.templates",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.templates"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2dcc133a7afdd007c6116ad7dc2c5dad52a966dc63726852f05764af1df6117d:1"
          }
        },
        {
          "ruleId": "CVE-2026-54411-libpam0g",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libpam0g, version 1.5.2-6+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libpam0g/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libpam0g/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam0g:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam0g:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "687a2ec61afd9876bcbdcbbd1527ef483460df26021db7eb6e25b77ee2d6a37a:1"
          }
        },
        {
          "ruleId": "CVE-2026-5435-libc-bin",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-5435-libc6",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2019-1010022-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2019-1010022-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-8674-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-8674-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2019-1010024-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2019-1010024-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2019-1010023-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2019-1010023-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-78410-bsdutils",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: bsdutils, version 1:2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/bsdutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/bsdutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "51a2b3eb98cd1c97e76bc6bb58db803a82e978d6de088edc3332471c9db2becf:1"
          }
        },
        {
          "ruleId": "CVE-2026-78410-libblkid1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libblkid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libblkid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libblkid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libblkid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libblkid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "534a8e87480f3963eec561ccedd5a2c057b16f323c23bf7446cc387dc8736bc3:1"
          }
        },
        {
          "ruleId": "CVE-2026-78410-libmount1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libmount1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libmount1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libmount1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libmount1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libmount1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "fa217c11b0cc619816dd4be890cb20129cbcbfb114b768ca24b13e6baa3e6004:1"
          }
        },
        {
          "ruleId": "CVE-2026-78410-libsmartcols1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libsmartcols1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsmartcols1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsmartcols1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsmartcols1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsmartcols1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "69b210f67380054c97498fcf5715176fbd274047c3bd42c58343e2e9718a7086:1"
          }
        },
        {
          "ruleId": "CVE-2026-78410-libuuid1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libuuid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libuuid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libuuid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libuuid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libuuid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "33eb426befb943351f34d4cd44551778161b3810b05399d358e10c6182eb2629:1"
          }
        },
        {
          "ruleId": "CVE-2026-78410-mount",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: mount, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/mount/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/mount/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2b23a096f0dfd926935be7cc47d1f2d08ab59b4caeb2f1eb9d01c4fc15d4d900:1"
          }
        },
        {
          "ruleId": "CVE-2026-78410-util-linux",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: util-linux, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6e6fa287bae9b3826f47633badba6b5c6e5a7964d2d7b01462ed0c37e95ad4d5:1"
          }
        },
        {
          "ruleId": "CVE-2026-78410-util-linux-extra",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: util-linux-extra, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux-extra/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux-extra/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.preinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4a4f2e8358ffe479825ba4fc1a0226e70955b8803ad09494e61e86cc1f61d784:1"
          }
        },
        {
          "ruleId": "CVE-2024-56433-login",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: login, version 1:4.13+dfsg1-1+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/login/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/login/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/login.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/login.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/login.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.list"
                },
                {
                  "name": "/var/lib/dpkg/info/login.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/login.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/login.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/login.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6c20a0e3e235c929390b5410903a6d3684fa2e70632e00687924ee83d47b2ac4:1"
          }
        },
        {
          "ruleId": "CVE-2024-56433-passwd",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: passwd, version 1:4.13+dfsg1-1+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/passwd/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/passwd/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.list"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "7a886ed0c04ce9e19df80820593011ec96c521994b1cd5e4017f19999b19a5b6:1"
          }
        },
        {
          "ruleId": "CVE-2026-53615-bsdutils",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: bsdutils, version 1:2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/bsdutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/bsdutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "51a2b3eb98cd1c97e76bc6bb58db803a82e978d6de088edc3332471c9db2becf:1"
          }
        },
        {
          "ruleId": "CVE-2026-53615-libblkid1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libblkid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libblkid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libblkid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libblkid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libblkid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "534a8e87480f3963eec561ccedd5a2c057b16f323c23bf7446cc387dc8736bc3:1"
          }
        },
        {
          "ruleId": "CVE-2026-53615-libmount1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libmount1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libmount1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libmount1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libmount1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libmount1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "fa217c11b0cc619816dd4be890cb20129cbcbfb114b768ca24b13e6baa3e6004:1"
          }
        },
        {
          "ruleId": "CVE-2026-53615-libsmartcols1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libsmartcols1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsmartcols1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsmartcols1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsmartcols1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsmartcols1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "69b210f67380054c97498fcf5715176fbd274047c3bd42c58343e2e9718a7086:1"
          }
        },
        {
          "ruleId": "CVE-2026-53615-libuuid1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libuuid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libuuid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libuuid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libuuid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libuuid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "33eb426befb943351f34d4cd44551778161b3810b05399d358e10c6182eb2629:1"
          }
        },
        {
          "ruleId": "CVE-2026-53615-mount",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: mount, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/mount/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/mount/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2b23a096f0dfd926935be7cc47d1f2d08ab59b4caeb2f1eb9d01c4fc15d4d900:1"
          }
        },
        {
          "ruleId": "CVE-2026-53615-util-linux",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: util-linux, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6e6fa287bae9b3826f47633badba6b5c6e5a7964d2d7b01462ed0c37e95ad4d5:1"
          }
        },
        {
          "ruleId": "CVE-2026-53615-util-linux-extra",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: util-linux-extra, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux-extra/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux-extra/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.preinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4a4f2e8358ffe479825ba4fc1a0226e70955b8803ad09494e61e86cc1f61d784:1"
          }
        },
        {
          "ruleId": "CVE-2010-4756-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2010-4756-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-27171-zlib1g",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: zlib1g, version 1:1.2.13.dfsg-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/zlib1g/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/zlib1g/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/zlib1g:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/zlib1g:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f8e351ed912a944098def4bde23e72742117a3b764e7970a3ff6f89ba0292864:1"
          }
        },
        {
          "ruleId": "CVE-2026-115819-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-115819-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2024-10041-libpam-modules",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libpam-modules, version 1.5.2-6+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libpam-modules/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libpam-modules/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-modules:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-modules:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-modules:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-modules:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "02cff43398ea18cf80d671ff206a8f12b85576b37d07bf74ac11a5ae935ed291:1"
          }
        },
        {
          "ruleId": "CVE-2024-10041-libpam-modules-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libpam-modules-bin, version 1.5.2-6+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libpam-modules-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libpam-modules-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-modules-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-modules-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-modules-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-modules-bin.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "87ef29c52f7720c2457fdff05c52a957b4c7ff8af0e0221455184ba1993c3db9:1"
          }
        },
        {
          "ruleId": "CVE-2024-10041-libpam-runtime",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libpam-runtime, version 1.5.2-6+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libpam-runtime/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libpam-runtime/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.prerm"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam-runtime.templates",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam-runtime.templates"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2dcc133a7afdd007c6116ad7dc2c5dad52a966dc63726852f05764af1df6117d:1"
          }
        },
        {
          "ruleId": "CVE-2024-10041-libpam0g",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libpam0g, version 1.5.2-6+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libpam0g/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libpam0g/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libpam0g:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libpam0g:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "687a2ec61afd9876bcbdcbbd1527ef483460df26021db7eb6e25b77ee2d6a37a:1"
          }
        },
        {
          "ruleId": "CVE-2016-2781-coreutils",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: coreutils, version 9.1-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/coreutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/coreutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.list"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postrm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "088217943e783e7f379a0ae1f296727eab3b82c6376aea7c8affe80909639783:1"
          }
        },
        {
          "ruleId": "CVE-2026-6791-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-6791-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2019-1010025-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2019-1010025-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2019-9192-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2019-9192-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-19542-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-19542-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-53613-bsdutils",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: bsdutils, version 1:2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/bsdutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/bsdutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "51a2b3eb98cd1c97e76bc6bb58db803a82e978d6de088edc3332471c9db2becf:1"
          }
        },
        {
          "ruleId": "CVE-2026-53613-libblkid1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libblkid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libblkid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libblkid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libblkid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libblkid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "534a8e87480f3963eec561ccedd5a2c057b16f323c23bf7446cc387dc8736bc3:1"
          }
        },
        {
          "ruleId": "CVE-2026-53613-libmount1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libmount1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libmount1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libmount1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libmount1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libmount1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "fa217c11b0cc619816dd4be890cb20129cbcbfb114b768ca24b13e6baa3e6004:1"
          }
        },
        {
          "ruleId": "CVE-2026-53613-libsmartcols1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libsmartcols1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsmartcols1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsmartcols1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsmartcols1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsmartcols1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "69b210f67380054c97498fcf5715176fbd274047c3bd42c58343e2e9718a7086:1"
          }
        },
        {
          "ruleId": "CVE-2026-53613-libuuid1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libuuid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libuuid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libuuid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libuuid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libuuid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "33eb426befb943351f34d4cd44551778161b3810b05399d358e10c6182eb2629:1"
          }
        },
        {
          "ruleId": "CVE-2026-53613-mount",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: mount, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/mount/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/mount/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2b23a096f0dfd926935be7cc47d1f2d08ab59b4caeb2f1eb9d01c4fc15d4d900:1"
          }
        },
        {
          "ruleId": "CVE-2026-53613-util-linux",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: util-linux, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6e6fa287bae9b3826f47633badba6b5c6e5a7964d2d7b01462ed0c37e95ad4d5:1"
          }
        },
        {
          "ruleId": "CVE-2026-53613-util-linux-extra",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: util-linux-extra, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux-extra/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux-extra/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.preinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4a4f2e8358ffe479825ba4fc1a0226e70955b8803ad09494e61e86cc1f61d784:1"
          }
        },
        {
          "ruleId": "CVE-2026-100290-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-100290-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-54369-libacl1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libacl1, version 2.3.1-3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libacl1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libacl1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libacl1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libacl1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b34910b3a85f0009d88a0952493256659eaea797de91c2f545725a9db794bf27:1"
          }
        },
        {
          "ruleId": "CVE-2026-89092-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-89092-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-95692-libssl3",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libssl3, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libssl3/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/libssl3/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libssl3:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/libssl3:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4c8e166222e87f9b23523ea0d8b697761a293aadbae58ec44a65a01e140fb0bc:1"
          }
        },
        {
          "ruleId": "CVE-2026-95692-openssl",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: openssl, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/openssl/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/openssl/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.list"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.postinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "1634fc4d02c5d267104e93ae265dc758c5dea08972c675f7074687a74b839f1c:1"
          }
        },
        {
          "ruleId": "CVE-2026-115456-gcc-12-base",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: gcc-12-base, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gcc-12-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gcc-12-base:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gcc-12-base:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "29fd540536545577f5b63bd719de36dc38b793b477b2ef9c3e4253d04b2d2ea8:1"
          }
        },
        {
          "ruleId": "CVE-2026-115456-libgcc-s1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgcc-s1, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgcc-s1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgcc-s1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgcc-s1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f1344a44c4beb6aebd0ed70e19f0e398101d438d59e15f714676c66e15d1377e:1"
          }
        },
        {
          "ruleId": "CVE-2026-115456-libstdc++6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libstdc++6, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libstdc++6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libstdc++6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libstdc++6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b8eb81cb8a98ed7eacc05ec51b022a8f22d9cf8d62a0098d3e3bd28610954ff0:1"
          }
        },
        {
          "ruleId": "CVE-2025-6141-libtinfo6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libtinfo6, version 6.4-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libtinfo6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libtinfo6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libtinfo6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libtinfo6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "78b32bda088de644f4f1b58feb81283a86251bbb5036b71ddd8115ab129fa7a4:1"
          }
        },
        {
          "ruleId": "CVE-2025-6141-ncurses-base",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: ncurses-base, version 6.4-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/ncurses-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/ncurses-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-base.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-base.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-base.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-base.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-base.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-base.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "84efbc3133e553e7bf2ccbfbdb694f09bd4fece367db4521f19ca318251486fb:1"
          }
        },
        {
          "ruleId": "CVE-2025-6141-ncurses-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: ncurses-bin, version 6.4-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/ncurses-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/ncurses-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/ncurses-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/ncurses-bin.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "aa74d63bbc541f32ea937f40b78ce73e05cec28b352479d5d20c4a4dcd4783b1:1"
          }
        },
        {
          "ruleId": "CVE-2026-88822-libssl3",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libssl3, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libssl3/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/libssl3/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libssl3:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/libssl3:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4c8e166222e87f9b23523ea0d8b697761a293aadbae58ec44a65a01e140fb0bc:1"
          }
        },
        {
          "ruleId": "CVE-2026-88822-openssl",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: openssl, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/openssl/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/openssl/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.list"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.postinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "1634fc4d02c5d267104e93ae265dc758c5dea08972c675f7074687a74b839f1c:1"
          }
        },
        {
          "ruleId": "CVE-2026-95691-libssl3",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libssl3, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libssl3/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/libssl3/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libssl3:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/libssl3:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4c8e166222e87f9b23523ea0d8b697761a293aadbae58ec44a65a01e140fb0bc:1"
          }
        },
        {
          "ruleId": "CVE-2026-95691-openssl",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: openssl, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/openssl/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/openssl/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.list"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.postinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "1634fc4d02c5d267104e93ae265dc758c5dea08972c675f7074687a74b839f1c:1"
          }
        },
        {
          "ruleId": "CVE-2026-97399-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-97399-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2025-30258-gpgv",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: gpgv, version 2.2.40-1.1+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gpgv/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gpgv/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2fa4d1e8d91afc655a8066d628c6bc126743369e20be8f0dfffa00b6444b1cf3:1"
          }
        },
        {
          "ruleId": "CVE-2018-6829-libgcrypt20",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgcrypt20, version 1.10.1-3+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libgcrypt20/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgcrypt20/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgcrypt20:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgcrypt20:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "45f6c606291f9f9ba9e72ac595862eb72fdb16168edce1c356ec31ea6ba101b0:1"
          }
        },
        {
          "ruleId": "CVE-2026-15534-perl-base",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: perl-base, version 5.36.0-7+deb12u4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/perl-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/perl-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.list"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "8ca9a169038c6959f92aec597f69ecea220d335109dea9da6fc6a4878ee9e8c5:1"
          }
        },
        {
          "ruleId": "CVE-2023-31486-perl-base",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: perl-base, version 5.36.0-7+deb12u4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/perl-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/perl-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.list"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "8ca9a169038c6959f92aec597f69ecea220d335109dea9da6fc6a4878ee9e8c5:1"
          }
        },
        {
          "ruleId": "CVE-2026-13757-libp11-kit0",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libp11-kit0, version 0.24.1-2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libp11-kit0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libp11-kit0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libp11-kit0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libp11-kit0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2f32f9a89918edef5110ab02903b5342a8737a34e6c65b7f855301aadc64516e:1"
          }
        },
        {
          "ruleId": "CVE-2026-15059-libsystemd0",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libsystemd0, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsystemd0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsystemd0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsystemd0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "98e2601951b5f65c28727c296725690305eba8f9f2eaff5425a9114396234ae6:1"
          }
        },
        {
          "ruleId": "CVE-2026-15059-libudev1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libudev1, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libudev1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libudev1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libudev1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libudev1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "73fcb1519bb9908fa31a0ee7b60e893ebc042897c9bc8bef743019ee4ca24bbf:1"
          }
        },
        {
          "ruleId": "CVE-2026-54371-libattr1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libattr1, version 1:2.5.1-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libattr1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libattr1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libattr1:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libattr1:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libattr1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libattr1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3bdb3385650e285bb6a0b904f7210c20499f91033dea10047cd8b866f77dafc8:1"
          }
        },
        {
          "ruleId": "CVE-2026-27456-bsdutils",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: bsdutils, version 1:2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/bsdutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/bsdutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "51a2b3eb98cd1c97e76bc6bb58db803a82e978d6de088edc3332471c9db2becf:1"
          }
        },
        {
          "ruleId": "CVE-2026-27456-libblkid1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libblkid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libblkid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libblkid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libblkid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libblkid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "534a8e87480f3963eec561ccedd5a2c057b16f323c23bf7446cc387dc8736bc3:1"
          }
        },
        {
          "ruleId": "CVE-2026-27456-libmount1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libmount1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libmount1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libmount1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libmount1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libmount1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "fa217c11b0cc619816dd4be890cb20129cbcbfb114b768ca24b13e6baa3e6004:1"
          }
        },
        {
          "ruleId": "CVE-2026-27456-libsmartcols1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libsmartcols1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsmartcols1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsmartcols1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsmartcols1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsmartcols1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "69b210f67380054c97498fcf5715176fbd274047c3bd42c58343e2e9718a7086:1"
          }
        },
        {
          "ruleId": "CVE-2026-27456-libuuid1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libuuid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libuuid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libuuid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libuuid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libuuid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "33eb426befb943351f34d4cd44551778161b3810b05399d358e10c6182eb2629:1"
          }
        },
        {
          "ruleId": "CVE-2026-27456-mount",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: mount, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/mount/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/mount/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2b23a096f0dfd926935be7cc47d1f2d08ab59b4caeb2f1eb9d01c4fc15d4d900:1"
          }
        },
        {
          "ruleId": "CVE-2026-27456-util-linux",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: util-linux, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6e6fa287bae9b3826f47633badba6b5c6e5a7964d2d7b01462ed0c37e95ad4d5:1"
          }
        },
        {
          "ruleId": "CVE-2026-27456-util-linux-extra",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: util-linux-extra, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux-extra/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux-extra/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.preinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4a4f2e8358ffe479825ba4fc1a0226e70955b8803ad09494e61e86cc1f61d784:1"
          }
        },
        {
          "ruleId": "CVE-2026-13595-bsdutils",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: bsdutils, version 1:2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/bsdutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/bsdutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "51a2b3eb98cd1c97e76bc6bb58db803a82e978d6de088edc3332471c9db2becf:1"
          }
        },
        {
          "ruleId": "CVE-2026-13595-libblkid1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libblkid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libblkid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libblkid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libblkid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libblkid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "534a8e87480f3963eec561ccedd5a2c057b16f323c23bf7446cc387dc8736bc3:1"
          }
        },
        {
          "ruleId": "CVE-2026-13595-libmount1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libmount1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libmount1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libmount1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libmount1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libmount1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "fa217c11b0cc619816dd4be890cb20129cbcbfb114b768ca24b13e6baa3e6004:1"
          }
        },
        {
          "ruleId": "CVE-2026-13595-libsmartcols1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libsmartcols1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsmartcols1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsmartcols1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsmartcols1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsmartcols1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "69b210f67380054c97498fcf5715176fbd274047c3bd42c58343e2e9718a7086:1"
          }
        },
        {
          "ruleId": "CVE-2026-13595-libuuid1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libuuid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libuuid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libuuid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libuuid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libuuid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "33eb426befb943351f34d4cd44551778161b3810b05399d358e10c6182eb2629:1"
          }
        },
        {
          "ruleId": "CVE-2026-13595-mount",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: mount, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/mount/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/mount/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2b23a096f0dfd926935be7cc47d1f2d08ab59b4caeb2f1eb9d01c4fc15d4d900:1"
          }
        },
        {
          "ruleId": "CVE-2026-13595-util-linux",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: util-linux, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6e6fa287bae9b3826f47633badba6b5c6e5a7964d2d7b01462ed0c37e95ad4d5:1"
          }
        },
        {
          "ruleId": "CVE-2026-13595-util-linux-extra",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: util-linux-extra, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux-extra/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux-extra/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.preinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4a4f2e8358ffe479825ba4fc1a0226e70955b8803ad09494e61e86cc1f61d784:1"
          }
        },
        {
          "ruleId": "CVE-2026-114690-gcc-12-base",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: gcc-12-base, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gcc-12-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gcc-12-base:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gcc-12-base:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "29fd540536545577f5b63bd719de36dc38b793b477b2ef9c3e4253d04b2d2ea8:1"
          }
        },
        {
          "ruleId": "CVE-2026-114690-libgcc-s1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libgcc-s1, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgcc-s1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgcc-s1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgcc-s1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f1344a44c4beb6aebd0ed70e19f0e398101d438d59e15f714676c66e15d1377e:1"
          }
        },
        {
          "ruleId": "CVE-2026-114690-libstdc++6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libstdc++6, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libstdc++6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libstdc++6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libstdc++6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b8eb81cb8a98ed7eacc05ec51b022a8f22d9cf8d62a0098d3e3bd28610954ff0:1"
          }
        },
        {
          "ruleId": "CVE-2026-18374-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-18374-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-88823-libssl3",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libssl3, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libssl3/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/libssl3/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libssl3:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/libssl3:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4c8e166222e87f9b23523ea0d8b697761a293aadbae58ec44a65a01e140fb0bc:1"
          }
        },
        {
          "ruleId": "CVE-2026-88823-openssl",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: openssl, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/openssl/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/openssl/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.list"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.postinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "1634fc4d02c5d267104e93ae265dc758c5dea08972c675f7074687a74b839f1c:1"
          }
        },
        {
          "ruleId": "CVE-2026-18508-tar",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: tar, version 1.34+dfsg-1.2+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/tar/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/tar/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.list"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "c6ef66502513a49456229d7f627a79317de0b01b06a7b9260654c3d557fdde01:1"
          }
        },
        {
          "ruleId": "CVE-2026-54370-libacl1",
          "level": "error",
          "message": {
            "text": "A high vulnerability in deb package: libacl1, version 2.3.1-3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libacl1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libacl1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libacl1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libacl1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b34910b3a85f0009d88a0952493256659eaea797de91c2f545725a9db794bf27:1"
          }
        },
        {
          "ruleId": "CVE-2026-107496-libssl3",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libssl3, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libssl3/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/libssl3/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libssl3:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/libssl3:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4c8e166222e87f9b23523ea0d8b697761a293aadbae58ec44a65a01e140fb0bc:1"
          }
        },
        {
          "ruleId": "CVE-2026-107496-openssl",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: openssl, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/openssl/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/openssl/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.list"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.postinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "1634fc4d02c5d267104e93ae265dc758c5dea08972c675f7074687a74b839f1c:1"
          }
        },
        {
          "ruleId": "CVE-2026-42250-libbz2-1.0",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libbz2-1.0, version 1.0.8-5+b1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libbz2-1.0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libbz2-1.0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "c2cb25f5970b5eedefcd6b44e5de65ddb968e76a4d97936508f3e26de0861eaf:1"
          }
        },
        {
          "ruleId": "CVE-2026-18938-libp11-kit0",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libp11-kit0, version 0.24.1-2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libp11-kit0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libp11-kit0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libp11-kit0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libp11-kit0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2f32f9a89918edef5110ab02903b5342a8737a34e6c65b7f855301aadc64516e:1"
          }
        },
        {
          "ruleId": "CVE-2011-3374-apt",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: apt, version 2.6.2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/apt/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/apt/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/apt.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/apt.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/apt.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/apt.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/apt.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/apt.list"
                },
                {
                  "name": "/var/lib/dpkg/info/apt.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/apt.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/apt.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/apt.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/apt.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/apt.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/apt.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/apt.prerm"
                },
                {
                  "name": "/var/lib/dpkg/info/apt.shlibs",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/apt.shlibs"
                },
                {
                  "name": "/var/lib/dpkg/info/apt.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/apt.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "313053861b57a5b1d1cebcb188c649e1e6952736f5e79b41413f5882c6f05660:1"
          }
        },
        {
          "ruleId": "CVE-2011-3374-libapt-pkg6.0",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libapt-pkg6.0, version 2.6.2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libapt-pkg6.0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libapt-pkg6.0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libapt-pkg6.0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libapt-pkg6.0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "922b7864dd7a23b72b108bed4977017e847ce56961bf3552bad30b7758a55400:1"
          }
        },
        {
          "ruleId": "CVE-2024-2236-libgcrypt20",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgcrypt20, version 1.10.1-3+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libgcrypt20/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgcrypt20/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgcrypt20:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgcrypt20:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "45f6c606291f9f9ba9e72ac595862eb72fdb16168edce1c356ec31ea6ba101b0:1"
          }
        },
        {
          "ruleId": "CVE-2026-41991-gzip",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: gzip, version 1.12-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gzip/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gzip/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gzip.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gzip.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/gzip.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gzip.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "70eb1bfa602a04e05a48dc41c2ff7a97a0ef09d10226a64f00ca53bf1ee702dd:1"
          }
        },
        {
          "ruleId": "CVE-2026-40228-libsystemd0",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libsystemd0, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsystemd0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsystemd0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsystemd0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "98e2601951b5f65c28727c296725690305eba8f9f2eaff5425a9114396234ae6:1"
          }
        },
        {
          "ruleId": "CVE-2026-40228-libudev1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libudev1, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libudev1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libudev1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libudev1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libudev1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "73fcb1519bb9908fa31a0ee7b60e893ebc042897c9bc8bef743019ee4ca24bbf:1"
          }
        },
        {
          "ruleId": "CVE-2026-86805-libc-bin",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-86805-libc6",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2025-68972-gpgv",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: gpgv, version 2.2.40-1.1+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gpgv/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gpgv/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2fa4d1e8d91afc655a8066d628c6bc126743369e20be8f0dfffa00b6444b1cf3:1"
          }
        },
        {
          "ruleId": "CVE-2026-18477-tar",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: tar, version 1.34+dfsg-1.2+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/tar/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/tar/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.list"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/tar.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/tar.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "c6ef66502513a49456229d7f627a79317de0b01b06a7b9260654c3d557fdde01:1"
          }
        },
        {
          "ruleId": "CVE-2022-27943-gcc-12-base",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: gcc-12-base, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gcc-12-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gcc-12-base:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gcc-12-base:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "29fd540536545577f5b63bd719de36dc38b793b477b2ef9c3e4253d04b2d2ea8:1"
          }
        },
        {
          "ruleId": "CVE-2022-27943-libgcc-s1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgcc-s1, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgcc-s1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgcc-s1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgcc-s1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "f1344a44c4beb6aebd0ed70e19f0e398101d438d59e15f714676c66e15d1377e:1"
          }
        },
        {
          "ruleId": "CVE-2022-27943-libstdc++6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libstdc++6, version 12.2.0-14+deb12u1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gcc-12-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libstdc++6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libstdc++6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libstdc++6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b8eb81cb8a98ed7eacc05ec51b022a8f22d9cf8d62a0098d3e3bd28610954ff0:1"
          }
        },
        {
          "ruleId": "CVE-2007-5686-login",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: login, version 1:4.13+dfsg1-1+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/login/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/login/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/login.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/login.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/login.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.list"
                },
                {
                  "name": "/var/lib/dpkg/info/login.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/login.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/login.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/login.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/login.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6c20a0e3e235c929390b5410903a6d3684fa2e70632e00687924ee83d47b2ac4:1"
          }
        },
        {
          "ruleId": "CVE-2007-5686-passwd",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: passwd, version 1:4.13+dfsg1-1+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/passwd/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/passwd/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.list"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/passwd.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/passwd.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "7a886ed0c04ce9e19df80820593011ec96c521994b1cd5e4017f19999b19a5b6:1"
          }
        },
        {
          "ruleId": "CVE-2026-105712-gpgv",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: gpgv, version 2.2.40-1.1+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gpgv/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gpgv/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2fa4d1e8d91afc655a8066d628c6bc126743369e20be8f0dfffa00b6444b1cf3:1"
          }
        },
        {
          "ruleId": "CVE-2026-57062-gpgv",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: gpgv, version 2.2.40-1.1+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gpgv/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gpgv/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2fa4d1e8d91afc655a8066d628c6bc126743369e20be8f0dfffa00b6444b1cf3:1"
          }
        },
        {
          "ruleId": "CVE-2026-95818-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-95818-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2026-16742-libsystemd0",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libsystemd0, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsystemd0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsystemd0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsystemd0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "98e2601951b5f65c28727c296725690305eba8f9f2eaff5425a9114396234ae6:1"
          }
        },
        {
          "ruleId": "CVE-2026-16742-libudev1",
          "level": "warning",
          "message": {
            "text": "A medium vulnerability in deb package: libudev1, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libudev1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libudev1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libudev1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libudev1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "73fcb1519bb9908fa31a0ee7b60e893ebc042897c9bc8bef743019ee4ca24bbf:1"
          }
        },
        {
          "ruleId": "CVE-2026-6368-libc-bin",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc-bin, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc-bin/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc-bin/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.list"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/libc-bin.triggers",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc-bin.triggers"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "3c542ce18045aa9534b985b00d3b27122f5743751feb63838c1e0e44820b4561:1"
          }
        },
        {
          "ruleId": "CVE-2026-6368-libc6",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libc6, version 2.36-9+deb12u14 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libc6/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libc6/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/libc6:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libc6:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6765873a54dc809d56588751d4d481821c03167794419990e5de94772d823698:1"
          }
        },
        {
          "ruleId": "CVE-2011-4116-perl-base",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: perl-base, version 5.36.0-7+deb12u4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/perl-base/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/perl-base/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.list"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.preinst"
                },
                {
                  "name": "/var/lib/dpkg/info/perl-base.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/perl-base.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "8ca9a169038c6959f92aec597f69ecea220d335109dea9da6fc6a4878ee9e8c5:1"
          }
        },
        {
          "ruleId": "CVE-2013-4392-libsystemd0",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libsystemd0, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsystemd0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsystemd0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsystemd0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "98e2601951b5f65c28727c296725690305eba8f9f2eaff5425a9114396234ae6:1"
          }
        },
        {
          "ruleId": "CVE-2013-4392-libudev1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libudev1, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libudev1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libudev1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libudev1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libudev1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "73fcb1519bb9908fa31a0ee7b60e893ebc042897c9bc8bef743019ee4ca24bbf:1"
          }
        },
        {
          "ruleId": "CVE-2025-27587-libssl3",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libssl3, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libssl3/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/libssl3/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libssl3:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/libssl3:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4c8e166222e87f9b23523ea0d8b697761a293aadbae58ec44a65a01e140fb0bc:1"
          }
        },
        {
          "ruleId": "CVE-2025-27587-openssl",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: openssl, version 3.0.22-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/openssl/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/usr/share/doc/openssl/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.list"
                },
                {
                  "name": "/var/lib/dpkg/info/openssl.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/info/openssl.postinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "1634fc4d02c5d267104e93ae265dc758c5dea08972c675f7074687a74b839f1c:1"
          }
        },
        {
          "ruleId": "CVE-2022-0563-bsdutils",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: bsdutils, version 1:2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/bsdutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/bsdutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "51a2b3eb98cd1c97e76bc6bb58db803a82e978d6de088edc3332471c9db2becf:1"
          }
        },
        {
          "ruleId": "CVE-2022-0563-libblkid1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libblkid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libblkid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libblkid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libblkid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libblkid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "534a8e87480f3963eec561ccedd5a2c057b16f323c23bf7446cc387dc8736bc3:1"
          }
        },
        {
          "ruleId": "CVE-2022-0563-libmount1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libmount1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libmount1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libmount1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libmount1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libmount1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "fa217c11b0cc619816dd4be890cb20129cbcbfb114b768ca24b13e6baa3e6004:1"
          }
        },
        {
          "ruleId": "CVE-2022-0563-libsmartcols1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libsmartcols1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsmartcols1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsmartcols1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsmartcols1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsmartcols1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "69b210f67380054c97498fcf5715176fbd274047c3bd42c58343e2e9718a7086:1"
          }
        },
        {
          "ruleId": "CVE-2022-0563-libuuid1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libuuid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libuuid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libuuid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libuuid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libuuid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "33eb426befb943351f34d4cd44551778161b3810b05399d358e10c6182eb2629:1"
          }
        },
        {
          "ruleId": "CVE-2022-0563-mount",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: mount, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/mount/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/mount/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2b23a096f0dfd926935be7cc47d1f2d08ab59b4caeb2f1eb9d01c4fc15d4d900:1"
          }
        },
        {
          "ruleId": "CVE-2022-0563-util-linux",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: util-linux, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6e6fa287bae9b3826f47633badba6b5c6e5a7964d2d7b01462ed0c37e95ad4d5:1"
          }
        },
        {
          "ruleId": "CVE-2022-0563-util-linux-extra",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: util-linux-extra, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux-extra/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux-extra/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.preinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4a4f2e8358ffe479825ba4fc1a0226e70955b8803ad09494e61e86cc1f61d784:1"
          }
        },
        {
          "ruleId": "CVE-2023-31439-libsystemd0",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libsystemd0, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsystemd0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsystemd0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsystemd0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "98e2601951b5f65c28727c296725690305eba8f9f2eaff5425a9114396234ae6:1"
          }
        },
        {
          "ruleId": "CVE-2023-31439-libudev1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libudev1, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libudev1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libudev1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libudev1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libudev1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "73fcb1519bb9908fa31a0ee7b60e893ebc042897c9bc8bef743019ee4ca24bbf:1"
          }
        },
        {
          "ruleId": "CVE-2017-18018-coreutils",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: coreutils, version 9.1-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/coreutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/coreutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.list"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postrm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "088217943e783e7f379a0ae1f296727eab3b82c6376aea7c8affe80909639783:1"
          }
        },
        {
          "ruleId": "CVE-2023-31437-libsystemd0",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libsystemd0, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsystemd0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsystemd0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsystemd0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "98e2601951b5f65c28727c296725690305eba8f9f2eaff5425a9114396234ae6:1"
          }
        },
        {
          "ruleId": "CVE-2023-31437-libudev1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libudev1, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libudev1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libudev1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libudev1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libudev1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "73fcb1519bb9908fa31a0ee7b60e893ebc042897c9bc8bef743019ee4ca24bbf:1"
          }
        },
        {
          "ruleId": "CVE-2023-31438-libsystemd0",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libsystemd0, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsystemd0/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsystemd0/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsystemd0:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsystemd0:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "98e2601951b5f65c28727c296725690305eba8f9f2eaff5425a9114396234ae6:1"
          }
        },
        {
          "ruleId": "CVE-2023-31438-libudev1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libudev1, version 252.39-1~deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libudev1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libudev1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libudev1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libudev1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "73fcb1519bb9908fa31a0ee7b60e893ebc042897c9bc8bef743019ee4ca24bbf:1"
          }
        },
        {
          "ruleId": "CVE-2025-5278-coreutils",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: coreutils, version 9.1-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/coreutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/coreutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.list"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postrm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "088217943e783e7f379a0ae1f296727eab3b82c6376aea7c8affe80909639783:1"
          }
        },
        {
          "ruleId": "CVE-2022-3219-gpgv",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: gpgv, version 2.2.40-1.1+deb12u2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/gpgv/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/gpgv/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/gpgv.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/gpgv.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2fa4d1e8d91afc655a8066d628c6bc126743369e20be8f0dfffa00b6444b1cf3:1"
          }
        },
        {
          "ruleId": "CVE-2026-53910-diffutils",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: diffutils, version 1:3.8-4 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/diffutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/diffutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/diffutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/diffutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/diffutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/diffutils.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "44849d75ef26adad08ef294b9219d2aaa8c2f9c7b5a354188cd85d3622bb9cfc:1"
          }
        },
        {
          "ruleId": "CVE-2026-88647-libgnutls30",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgnutls30, version 3.7.9-2+deb12u7 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libgnutls30/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgnutls30/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgnutls30:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgnutls30:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "a765d4ad9e7eb7703af5a318fe9ecbf4848746f981eb0c1da3e29238b5ac5bd5:1"
          }
        },
        {
          "ruleId": "CVE-2025-14104-bsdutils",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: bsdutils, version 1:2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/bsdutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/bsdutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/bsdutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/bsdutils.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "51a2b3eb98cd1c97e76bc6bb58db803a82e978d6de088edc3332471c9db2becf:1"
          }
        },
        {
          "ruleId": "CVE-2025-14104-libblkid1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libblkid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libblkid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libblkid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libblkid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libblkid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "534a8e87480f3963eec561ccedd5a2c057b16f323c23bf7446cc387dc8736bc3:1"
          }
        },
        {
          "ruleId": "CVE-2025-14104-libmount1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libmount1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libmount1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libmount1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libmount1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libmount1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "fa217c11b0cc619816dd4be890cb20129cbcbfb114b768ca24b13e6baa3e6004:1"
          }
        },
        {
          "ruleId": "CVE-2025-14104-libsmartcols1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libsmartcols1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libsmartcols1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libsmartcols1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libsmartcols1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libsmartcols1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "69b210f67380054c97498fcf5715176fbd274047c3bd42c58343e2e9718a7086:1"
          }
        },
        {
          "ruleId": "CVE-2025-14104-libuuid1",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libuuid1, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libuuid1/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libuuid1/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libuuid1:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libuuid1:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "33eb426befb943351f34d4cd44551778161b3810b05399d358e10c6182eb2629:1"
          }
        },
        {
          "ruleId": "CVE-2025-14104-mount",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: mount, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/mount/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/mount/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/mount.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/mount.list"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "2b23a096f0dfd926935be7cc47d1f2d08ab59b4caeb2f1eb9d01c4fc15d4d900:1"
          }
        },
        {
          "ruleId": "CVE-2025-14104-util-linux",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: util-linux, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "6e6fa287bae9b3826f47633badba6b5c6e5a7964d2d7b01462ed0c37e95ad4d5:1"
          }
        },
        {
          "ruleId": "CVE-2025-14104-util-linux-extra",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: util-linux-extra, version 2.38.1-5+deb12u3 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/util-linux-extra/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/util-linux-extra/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.conffiles",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.conffiles"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.list"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/util-linux-extra.preinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/util-linux-extra.preinst"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "4a4f2e8358ffe479825ba4fc1a0226e70955b8803ad09494e61e86cc1f61d784:1"
          }
        },
        {
          "ruleId": "CVE-2026-95184-libgnutls30",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgnutls30, version 3.7.9-2+deb12u7 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libgnutls30/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgnutls30/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgnutls30:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgnutls30:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "a765d4ad9e7eb7703af5a318fe9ecbf4848746f981eb0c1da3e29238b5ac5bd5:1"
          }
        },
        {
          "ruleId": "CVE-2026-88648-libgnutls30",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgnutls30, version 3.7.9-2+deb12u7 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libgnutls30/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgnutls30/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgnutls30:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgnutls30:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "a765d4ad9e7eb7703af5a318fe9ecbf4848746f981eb0c1da3e29238b5ac5bd5:1"
          }
        },
        {
          "ruleId": "CVE-2026-95210-libgnutls30",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgnutls30, version 3.7.9-2+deb12u7 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libgnutls30/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgnutls30/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgnutls30:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgnutls30:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "a765d4ad9e7eb7703af5a318fe9ecbf4848746f981eb0c1da3e29238b5ac5bd5:1"
          }
        },
        {
          "ruleId": "CVE-2026-56392-coreutils",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: coreutils, version 9.1-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/coreutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/coreutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.list"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postrm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "088217943e783e7f379a0ae1f296727eab3b82c6376aea7c8affe80909639783:1"
          }
        },
        {
          "ruleId": "CVE-2026-67693-libgnutls30",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: libgnutls30, version 3.7.9-2+deb12u7 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/libgnutls30/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/libgnutls30/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/libgnutls30:amd64.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/libgnutls30:amd64.md5sums"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "a765d4ad9e7eb7703af5a318fe9ecbf4848746f981eb0c1da3e29238b5ac5bd5:1"
          }
        },
        {
          "ruleId": "CVE-2026-56391-coreutils",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: coreutils, version 9.1-1 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/coreutils/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/coreutils/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.list"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/coreutils.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/coreutils.postrm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "088217943e783e7f379a0ae1f296727eab3b82c6376aea7c8affe80909639783:1"
          }
        },
        {
          "ruleId": "CVE-2026-102474-dash",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: dash, version 0.5.12-2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/dash/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/dash/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.list"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b041399e3b5d61d3f2e801c053d42181c5a27727822e7bc7d8abc661b7299844:1"
          }
        },
        {
          "ruleId": "CVE-2026-102473-dash",
          "level": "note",
          "message": {
            "text": "A low vulnerability in deb package: dash, version 0.5.12-2 was found in image banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37 at: /var/lib/dpkg/status"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "banco-api//var/lib/dpkg/status"
                },
                "region": {
                  "startLine": 1,
                  "startColumn": 1,
                  "endLine": 1,
                  "endColumn": 1
                }
              },
              "logicalLocations": [
                {
                  "name": "/var/lib/dpkg/status",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:d808c30623f94160568fbf1ea5f50f4c9c84741c120051ab271f99fd372f89f5:/var/lib/dpkg/status"
                },
                {
                  "name": "/usr/share/doc/dash/copyright",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/usr/share/doc/dash/copyright"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.md5sums",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.md5sums"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.list",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.list"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.postinst",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.postinst"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.postrm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.postrm"
                },
                {
                  "name": "/var/lib/dpkg/info/dash.prerm",
                  "fullyQualifiedName": "banco-api:3c6fc04e455f4298b8cb8d0660d3a9e16d7aed37@sha256:1d7b9dd8778ebc4d9bf2f64436dd358640718cb349f5640b33bebaea4ffd62c2:/var/lib/dpkg/info/dash.prerm"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "primaryLocationLineHash": "b041399e3b5d61d3f2e801c053d42181c5a27727822e7bc7d8abc661b7299844:1"
          }
        }
      ]
    }
  ]
}